CVE-2020-12277 — Incorrect Default Permissions in Gitlab

CWE-276 — Incorrect Default Permissions5 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 76.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedApr 29
Latest updateMay 24

Description

GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDgitlab/gitlab10.8.0 — 12.7.8+2
▶debiandebian/gitlab< gitlab 13.2.3-2 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-7vrg-mmxg-pgfj: GitLab 10↗2022-05-24
▶
OSV
CVE-2020-12277: GitLab 10↗2020-04-29
▶

📋Vendor Advisories

2
GitLab
CVE-2020-12277: GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.↗2020-04-29
▶
Debian
CVE-2020-12277: gitlab - GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a rep...↗2020
▶