vulnerability
FreeBSD: VID-08FBA28B-6F9F-11EA-BD0B-001B217B3468 (CVE-2020-9795): Gitlab -- Multiple Vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:M/Au:N/C:C/I:C/A:C) | 2020-03-26 | 2020-03-27 | 2020-10-20 |
Description
Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.
From VID-08FBA28B-6F9F-11EA-BD0B-001B217B3468:
Gitlab reports:
Arbitrary File Read when Moving an Issue
Path Traversal in NPM Package Registry
SSRF on Project Import
External Users Can Create Personal Snippet
Triggers Decription Can be Updated by Other Maintainers in Project
Information Disclosure on Confidential Issues Moved to Private Programs
Potential DoS in Repository Archive Download
Blocked Users Can Still Pull/Push Docker Images
Repository Mirroring not Disabled when Feature not Activated
Vulnerability Feedback Page Was Leaking Information on Vulnerabilities
Stored XSS Vulnerability in Admin Feature
Upload Feature Allowed a User to Read Unauthorized Exported Files
Unauthorized Users Are Able to See CI Metrics
Last Pipeline Status of a Merge Request Leaked
Blind SSRF on FogBugz
Update Nokogiri dependency
Solution
References
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.