9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
68.7%
Gitlab reports:
Path traversal with potential remote code execution
Private objects exposed through project import
Disclosure of notes via Elasticsearch integration
Disclosure of comments via Elasticsearch integration
DNS Rebind SSRF in various chat notifications
Disclosure of vulnerability status in dependency list
Disclosure of commit count in Cycle Analytics
Exposure of related branch names
Tags pushes from blocked users
Branches and Commits exposed to Guest members via integration
IDOR when adding users to protected environments
Former project members able to access repository information
Unauthorized access to grafana metrics
Todos created for former project members
Update Mattermost dependency
Disclosure of AWS secret keys on certain Admin pages
Stored XSS in Group and User profile fields
Forked project information disclosed via Project API
Denial of Service in the issue and commit comment pages
Tokens stored in plaintext
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
68.7%