FreeBSD5F52D646-C31F-11EB-8DCF-001B217B3468Gitlab -- Multiple Vulnerabilities
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
34.4%
Gitlab reports:
Stealing GitLab OAuth access tokens using XSLeaks in Safari
Denial of service through recursive triggered pipelines
Unauthenticated CI lint API may lead to information disclosure and SSRF
Server-side DoS through rendering crafted Markdown documents
Issue and merge request length limit is not being enforced
Insufficient Expired Password Validation
XSS in blob viewer of notebooks
Logging of Sensitive Information
On-call rotation information exposed when removing a member
Spoofing commit author for signed commits
Enable qsh verification for Atlassian Connect
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
34.4%