p PatchFirst

CVE-2020-26415

CVE-2020-26415

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.

CVSS 4.3 · Medium · EPSS 0.8%

Published
Updated

Stack: system

Affected products and versions

  • gitlab

    Versions
    • >=12.2 to <13.4.7: Affected
    • >=13.5 to <13.5.5: Affected
    • >=13.6 to <13.6.2: Affected

    No fix published

  • gitlab Ubuntu:16.04:LTS

    Versions
    • 8.4.3+dfsg-9
    • 8.4.3+dfsg-12
    • 8.5.8+dfsg-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →