FreeBSD: VID-5D5E5CDA-38E6-11EB-BBBF-001B217B3468 (CVE-2020-26407): Gitlab -- Multiple vulnerabilities
Description
Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.
From VID-5D5E5CDA-38E6-11EB-BBBF-001B217B3468:
Gitlab reports:
XSS in Zoom Meeting URL
Limited Information Disclosure in Private Profile
User email exposed via GraphQL endpoint
Group and project membership potentially exposed via GraphQL
Search terms logged in search parameter in rails logs
Un-authorised access to feature flag user list
A specific query on the explore page causes statement timeouts
Exposure of starred projects on private user profiles
Uncontrolled Resource Consumption in any Markdown field using Mermaid
Former group members able to view updates to confidential epics
Update GraphicsMagick dependency
Update GnuPG dependency
Update libxml dependency
Solution(s)
- freebsd-upgrade-package-gitlab-ce
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center