CVE-2020-11649

CVE-2020-11649 affects GitLab CE/EE 8.15 through 12.9.2, where members of a group could retain access after the group is deleted. This is described as a design/logic flaw in multiple sources (e.g., BIT-GITLAB-2020-11649, CNVD-2020-25737, OSV: CVE-2020-11649). Impact is unauthorized access persist...

CVE-2020-11505

GitLab CE/EE prior to 12.7.9, 12.8.x prior to 12.8.9, and 12.9.x prior to 12.9.3 contain a vulnerability where a Workhorse bypass enables NuGet package and file disclosure via request smuggling, exposing sensitive information. A fix was released in GitLab 12.9.3 (and later). Affected components: ...

Design/Logic Flaw

GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...

CVE-2020-10980

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...

CVE-2020-10977

GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects...

CVE-2020-1732

A flaw was found in WildFly where multiple requests occurring concurrently could be handled using the identity of another request. This vulnerability occurs when using EE Security with WildFly Elytron. The largest threat from this vulnerability is data confidentiality and integrity...

GitLab: Stored XSS in markdown when redacting references

Summary It's possible to inject arbitrary html into the markdown by abusing the ReferenceRedactorFilter. This is due to the data-original attribute allowing html encoded data to be stored, which is then extracted and used as the link content. If the original data already is html encoded then it...

CVE-2020-10953

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...

CVE-2020-10953

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...

Path traversal

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...

CVE-2020-10953

Removed by vendor...

GitLab: SSRF on project import via the remote_attachment_url on a Note

Summary The Note model has an attachment which is provided by a CarrierWave uploader: ruby mountuploader :attachment, AttachmentUploader One of the features this provides is the ability to download and attach a file via a url, see...

CVE-2020-10073

CVE-2020-10073 affects GitLab EE versions 12.4.2–12.8.1. A DoS could be triggered by a flaw in permissions checks that may impact a project homepage. Exploitation details are not provided in the documents; no in‑the‑wild exploit info is referenced. Remediation is to upgrade to a fixed release (e....

CVE-2020-10084

GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...

CVE-2020-10084

GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...

Information disclosure

GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...

CVE-2020-10077

CVE-2020-10077 affects GitLab EE 3.0–12.8.1 and is caused by a deprecated service that enabled a server-side request forgery (SSRF) risk. The connected documents consistently describe the vulnerability as originating from that deprecated component, with no publicly provided details on exact vulne...

CVE-2020-10084

Removed by vendor...

CVE-2019-13121

An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control...

CVE-2019-12428

An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization...