Gitlab Gitlab Ee
10 CVEs affecting Gitlab Gitlab Ee. Latest disclosed: 2021-08-05. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15590 | High | 7.5 | 2020-01-28 | An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests… |
CVE-2019-5474 | Medium | 6.5 | 2020-01-28 | An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropr… |
CVE-2020-13348 | Medium | 5.7 | 2020-11-17 | An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch witho… |
CVE-2020-26406 | Medium | 5.3 | 2020-11-17 | Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to… |
CVE-2019-15582 | Medium | 5.3 | 2020-01-28 | An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any… |
CVE-2019-15581 | Medium | 5.3 | 2020-01-28 | An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to… |
CVE-2020-13349 | Medium | 4.3 | 2020-11-17 | An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Searc… |
CVE-2021-22240 | Medium | 4.2 | 2021-08-05 | Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled |
CVE-2020-26416 | Medium | 4.0 | 2020-12-11 | Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=… |
CVE-2020-26412 | Low | 3.1 | 2020-12-11 | Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2. |