Improper access control in Gitlab Community Edition and GitLab Enterprise Edition - #VU50849
Published: February 22, 2021
Vulnerability identifier: #VU50849
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the analytic pages.
Affected software
Gitlab Community Edition
GitLab Enterprise Edition
GitLab Enterprise Edition
Remediation
Install updates from vendor's website.
Gitlab Community Edition - addressed in versions 13.6.7, 13.7.7, 13.8.4
GitLab Enterprise Edition - addressed in versions 13.6.7, 13.7.7, 13.8.4
GitLab Enterprise Edition - addressed in versions 13.6.7, 13.7.7, 13.8.4