CVE-2020-26416

CWE-532 — Log File Information ExposureCWE-200 — Information Exposure6 documents6 sources
Severity
4.4MEDIUM
EPSS
0.0%
top 87.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Gitlab GitlabGitlab Gitlab EE
Timeline
PublishedDec 11
Latest updateMay 24

Description

Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to =13.5 to =13.6 to <13.6.2.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:NExploitability: 0.3 | Impact: 3.6

Affected Packages2 packages

▶NVDgitlab/gitlab8.4.0 — 13.4.7+2
▶CVEListV5gitlab/gitlab_ee>=13.5 to <13.5.5, >=13.6 to <13.6.2, >=8.4 to <13.4.7+2

🔴Vulnerability Details

3
GHSA
GHSA-h9gg-fc6x-px6c: Information disclosure in Advanced Search component of GitLab EE starting from 8↗2022-05-24
▶
CVEList
CVE-2020-26416: Information disclosure in Advanced Search component of GitLab EE starting from 8↗2020-12-11
▶
OSV
CVE-2020-26416: Information disclosure in Advanced Search component of GitLab EE starting from 8↗2020-12-11
▶

📋Vendor Advisories

2
GitLab
CVE-2020-26416: Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects ve↗2020-12-11
▶
Debian
CVE-2020-26416: gitlab - Information disclosure in Advanced Search component of GitLab EE starting from 8...↗2020
▶