HIGH

CVE-2018-20499

Gitlab GitLab 2019-12-30 CVSS v3.1

CVSS

7.2

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

Summary dbcve.org

Server-Side Request Forgery (SSRF) vulnerability in GitLab Community and Enterprise Edition allows an attacker to make the GitLab server perform requests to attacker-controlled destinations, potentially accessing internal services or infrastructure.

Mitigation

Upgrade GitLab to version 11.4.13, 11.5.6, 11.6.1 or later to receive the vendor patch for this SSRF vulnerability.

Weakness (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

EPSS Score

0.73%

Probability of exploitation in next 30 days

52.7th percentile

References

https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ Vendor Advisory https://gitlab.com/gitlab-org/gitlab-ce/issues/55439 Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE