Lucene search

GitLabCVE-2020-26416

HistoryDec 11, 2020 - 4:15 a.m.

CVE-2020-26416

2020-12-1104:15:11

CWE-532

GitLab

web.nvd.nist.gov

cve-2020-26416

gitlab

information disclosure

security vulnerability

advanced search

rails logs

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

Percentile

12.6%

JSON

Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.

Affected configurations

Nvd

Vulners

Node

gitlabgitlabRange8.4.0–13.4.7community

gitlabgitlabRange8.4.0–13.4.7enterprise

gitlabgitlabRange13.5.0–13.5.5community

gitlabgitlabRange13.5.0–13.5.5enterprise

gitlabgitlabRange13.6.0–13.6.2community

gitlabgitlabRange13.6.0–13.6.2enterprise

VendorProductVersionCPE
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::community:::*
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

CNA Affected

[
  {
    "product": "GitLab EE",
    "vendor": "GitLab",
    "versions": [
      {
        "status": "affected",
        "version": ">=8.4 to <13.4.7"
      },
      {
        "status": "affected",
        "version": ">=13.5 to <13.5.5"
      },
      {
        "status": "affected",
        "version": ">=13.6 to <13.6.2"
      }
    ]
  }
]

References

gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26416.json

gitlab.com/gitlab-org/gitlab/-/issues/244495

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2020-26416