6.5

CVE-2020-10955

GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitlab ≫ GitLab SwEditioncommunity Version >= 11.1.0 < 12.9.1
Gitlab ≫ GitLab SwEditionenterprise Version >= 11.1.0 < 12.9.1
Debian ≫ Debian Linux Version10.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.03% 0.592
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://about.gitlab.com/releases/categories/releases/
Vendor Advisory
Release Notes
https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
Vendor Advisory
Release Notes
https://www.debian.org/security/2020/dsa-4691
Third Party Advisory