Skip to content
fr Sign in
5.5 Medium

CVE-2020-26407 A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that…

Description

A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project

Affected products and versions

Product Affected versions Fixed in
GitLab CE/EE 13.6 earliest → latest 13.6.2
GitLab CE/EE 13.5 earliest → latest 13.5.5
GitLab CE/EE 13.4 earliest → < 13.4.7 13.4.7
GitLab CE/EE 12.4 12.4 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of GitLab CE/EE

The 22 CVEs of GitLab CE/EE →
CVE-2020-26408 A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to =13.5 to =13.6… 5.3 Medium CVE-2020-13357 An issue was discovered in Gitlab CE/EE versions >= 13.1 to = 13.5 to = 13.6… 4.3 Medium CVE-2020-26413 An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2 5.3 Medium CVE-2020-26417 Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership 5.3 Medium
Track this CVE