CVE-2018-20500
First published: Fri May 17 2019(Updated: )
An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=9.4.0<11.4.13 | |
| GitLab | >=9.4.0<11.4.13 | |
| GitLab | >=11.5.0<11.5.6 | |
| GitLab | >=11.5.0<11.5.6 | |
| GitLab | >=11.6.0<11.6.1 | |
| GitLab | >=11.6.0<11.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-20500?
CVE-2018-20500 has been classified as a high severity vulnerability due to its potential to expose sensitive tokens.
How do I fix CVE-2018-20500?
To fix CVE-2018-20500, upgrade your GitLab instance to version 11.6.1 or later.
What vulnerabilities are associated with CVE-2018-20500?
CVE-2018-20500 is associated with insecure permissions that affect the runner registration token in GitLab.
Which versions of GitLab are affected by CVE-2018-20500?
CVE-2018-20500 affects GitLab Community and Enterprise Editions from version 9.4 up to but not including 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
Who is at risk from CVE-2018-20500?
Users of GitLab who have maintainers that may leave the organization are at risk from CVE-2018-20500.
- agent/references
- agent/type
- agent/weakness
- agent/author
- agent/severity
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/9.4.0
- version/gitlab/11.5.0
- version/gitlab/11.6.0