CVE-2020-26412

3.1LOW

Key Information:

Vendor
Gitlab
Status
Gitlab Ee
Vendor
CVE Published:
11 December 2020

Summary

Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2.

Affected Version(s)

GitLab EE >=13.2, <13.4.7 < 13.2, 13.4.7

GitLab EE >=13.5, <13.5.5 < 13.5, 13.5.5

GitLab EE >=13.6, <13.6.2 < 13.6, 13.6.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/228670
x_refsource_MISC
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

This vulnerability has been discovered internally by the GitLab team
.