CVE-2018-20507 — Missing Authentication for Critical Function in Gitlab

CWE-306 — Missing Authentication for Critical Function4 documents4 sources

Severity

5.3MEDIUMNVD

EPSS

0.1%

top 70.02%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gitlab Debian Gitlab

Timeline

PublishedDec 30

Latest updateMay 24

Description

An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDgitlab/gitlab11.2.0 — 11.4.13+2

▶debiandebian/gitlab< gitlab 11.5.6+dfsg-1 (sid)

▶gitlabgitlab/gitlab

🔴Vulnerability Details

GHSA

GHSA-2xrp-4jrm-52gw: An issue was discovered in GitLab Enterprise Edition 11↗2022-05-24

▶

📋Vendor Advisories

GitLab

CVE-2018-20507: An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Inco↗2019-12-30

▶

Debian

CVE-2018-20507: gitlab - An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x befor...↗2018

▶