Lucene search

K
freebsdFreeBSD5D5E5CDA-38E6-11EB-BBBF-001B217B3468
HistoryDec 07, 2020 - 12:00 a.m.

Gitlab -- Multiple vulnerabilities

2020-12-0700:00:00
vuxml.freebsd.org
20

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

46.1%

Gitlab reports:

XSS in Zoom Meeting URL
Limited Information Disclosure in Private Profile
User email exposed via GraphQL endpoint
Group and project membership potentially exposed via GraphQL
Search terms logged in search parameter in rails logs
Un-authorised access to feature flag user list
A specific query on the explore page causes statement timeouts
Exposure of starred projects on private user profiles
Uncontrolled Resource Consumption in any Markdown field using Mermaid
Former group members able to view updates to confidential epics
Update GraphicsMagick dependency
Update GnuPG dependency
Update libxml dependency

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchgitlab-ce= 13.6.0UNKNOWN
FreeBSDanynoarchgitlab-ce< 13.6.2UNKNOWN

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

46.1%

Related for 5D5E5CDA-38E6-11EB-BBBF-001B217B3468