SB2020121501 - Multiple vulnerabilities in Gitlab 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020121501

SB2020121501 - Multiple vulnerabilities in Gitlab

Published: December 15, 2020 Updated: June 30, 2022

Security Bulletin ID SB2020121501
Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 10% Low 90%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2020-26407)

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via importing a malicious project in Zoom Meeting URL. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


2) Information disclosure (CVE-ID: CVE-2020-26408)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in private profile. A remote user can  view limited information in user's private profile.


3) Improper access control (CVE-ID: CVE-2020-13357)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions to feature flag user list. A remote user can get access the user list corresponding to a feature flag in a project.


4) Resource management error (CVE-ID: CVE-2020-26411)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. A remote user can use a specific query name for a project search that causes statement timeouts leads to a denial of service.


5) Resource exhaustion (CVE-ID: CVE-2020-26409)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when performing fields validation. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.


6) Information disclosure (CVE-ID: CVE-2020-26413)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to information disclosure via GraphQL starting. A remote attacker can access user emails.


7) Information disclosure (CVE-ID: CVE-2020-26417)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output via GraphQL. A remote attacker can retrieve private group and project membership.


8) Information disclosure (CVE-ID: CVE-2020-26416)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in Advanced Search component of GitLab EE via the search terms of Rails logs. A remote privileged user obtain sensitive information.


9) Information disclosure (CVE-ID: CVE-2020-26415)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive information about the starred projects for private user profiles. A remote user can gain unauthorized access to sensitive information.


10) Improper access control (CVE-ID: CVE-2020-26412)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics


Remediation

Install update from vendor's website.

References