CVE-2020-26415: Infoleak
Published Dec 11, 2020
·Updated
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Affected Software
6 affected components
GitLab GitLab>=12.2.0<13.4.7
GitLab GitLab>=12.2.0<13.4.7
GitLab GitLab>=13.5.0<13.5.5
GitLab GitLab>=13.5.0<13.5.5
GitLab GitLab>=13.6.0<13.6.2
GitLab GitLab>=13.6.0<13.6.2
Event History
Dec 11, 2020
CVE Published
via MITRE·03:29 AM
Data Sourced
via MITRE·03:29 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-26415?
CVE-2020-26415 is considered a medium severity vulnerability affecting specific versions of GitLab.
2
How do I fix CVE-2020-26415?
To fix CVE-2020-26415, upgrade GitLab to a version equal to or greater than 13.4.7, 13.5.5, or 13.6.2.
3
What type of data is exposed in CVE-2020-26415?
CVE-2020-26415 exposes information about starred projects for private user profiles via the GraphQL API.
4
Which versions of GitLab are affected by CVE-2020-26415?
CVE-2020-26415 affects GitLab versions greater than or equal to 12.2 and less than 13.4.7, along with specific ranges for 13.5 and 13.6.
5
Is CVE-2020-26415 specific to a certain GitLab edition?
CVE-2020-26415 affects both the community and enterprise editions of GitLab.