MEDIUM

CVE-2018-20497

Gitlab GitLab 2019-12-30 CVSS v3.1

CVSS

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

Summary dbcve.org

Server-Side Request Forgery (SSRF) vulnerability in GitLab Community and Enterprise Edition allows attackers to make the GitLab server perform arbitrary requests to internal or external resources, potentially accessing internal services or bypassing network restrictions.

Mitigation

Upgrade GitLab to version 11.4.13, 11.5.6, or 11.6.1 or later to patch the SSRF vulnerability.

Weakness (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

EPSS Score

0.66%

Probability of exploitation in next 30 days

50th percentile

References

https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ Vendor Advisory https://gitlab.com/gitlab-org/gitlab-ce/issues/51327 Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE