HIGH

CVE-2018-20229

Gitlab GitLab 2019-04-04 CVSS v3.0

CVSS

7.5

Description

GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal.

Summary dbcve.org

A directory traversal vulnerability in GitLab Community and Enterprise Edition allows attackers to access files outside the web root folder via path traversal sequences. This affects versions before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5, potentially enabling unauthorized read access to sensitive files on the host system.

Mitigation

Upgrade GitLab to version 11.3.14, 11.4.12, 11.5.5 or later. If immediate upgrade is not feasible, restrict file upload functionality and monitor for suspicious path traversal patterns in requests.

Weakness (CWE)

CWE-22 Path Traversal

EPSS Score

1.73%

Probability of exploitation in next 30 days

76.6th percentile

References

https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/ Release Notes, Vendor Advisory https://about.gitlab.com/blog/categories/releases/ Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE