4.3
Medium
CVE-2020-26409 A DOS vulnerability exists in Gitlab CE/EE >=10.3, =13.5,…
Description
A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GitLab CE/EE 13.6 | earliest → latest | 13.6.2 |
| GitLab CE/EE 13.5 | earliest → latest | 13.5.5 |
| GitLab CE/EE 13.4 | earliest → < 13.4.7 | 13.4.7 |
| GitLab CE/EE 10.3 | 10.3 → latest | No fix stated |
References
- gitlab.com gitlab.com
- hackerone.com hackerone.com
- gitlab.com gitlab.com
Timeline
- Published
- Last modified
Other CVEs of GitLab CE/EE
The 22 CVEs of GitLab CE/EE →
CVE-2020-26408
A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to =13.5 to =13.6…
5.3
Medium
CVE-2020-13357
An issue was discovered in Gitlab CE/EE versions >= 13.1 to = 13.5 to = 13.6…
4.3
Medium
CVE-2020-26413
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2
5.3
Medium
CVE-2020-26417
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership
5.3
Medium