Описание
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.
Ссылки
- Release NotesVendor Advisory
- Permissions Required
- Permissions Required
Уязвимые конфигурации
Конфигурация 1Версия от 17.6.5 (включая) до 19.3.6 (исключая)Версия от 17.6.5 (включая) до 19.3.6 (исключая)Версия от 19.4.0 (включая) до 19.4.3 (исключая)Версия от 19.4.0 (включая) до 19.4.3 (исключая)
Одно из
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*
EPSS
Процентиль: 20%
0.00277
Низкий
4.3 Medium
CVSS3
6.5 Medium
CVSS3
Дефекты
CWE-201
Связанные уязвимости
CVSS3: 4.3
github
17 дней назад
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.
EPSS
Процентиль: 20%
0.00277
Низкий
4.3 Medium
CVSS3
6.5 Medium
CVSS3
Дефекты
CWE-201