Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-5D5E5CDA-38E6-11EB-BBBF-001B217B3468 (CVE-2020-26407): Gitlab -- Multiple vulnerabilities

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

FreeBSD: VID-5D5E5CDA-38E6-11EB-BBBF-001B217B3468 (CVE-2020-26407): Gitlab -- Multiple vulnerabilities

Severity
4
CVSS
(AV:N/AC:M/Au:S/C:N/I:P/A:N)
Published
12/07/2020
Created
12/10/2020
Added
12/08/2020
Modified
12/16/2020

Description

Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.

From VID-5D5E5CDA-38E6-11EB-BBBF-001B217B3468:

Gitlab reports:

XSS in Zoom Meeting URL

Limited Information Disclosure in Private Profile

User email exposed via GraphQL endpoint

Group and project membership potentially exposed via GraphQL

Search terms logged in search parameter in rails logs

Un-authorised access to feature flag user list

A specific query on the explore page causes statement timeouts

Exposure of starred projects on private user profiles

Uncontrolled Resource Consumption in any Markdown field using Mermaid

Former group members able to view updates to confidential epics

Update GraphicsMagick dependency

Update GnuPG dependency

Update libxml dependency

Solution(s)

  • freebsd-upgrade-package-gitlab-ce

References

  • CVE-2020-26407

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;