CVE-2020-26416: Medium severity gitlab vulnerability
Published Dec 11, 2020
·Updated
Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Affected Software
6 affected components
GitLab GitLab>=8.4.0<13.4.7
GitLab GitLab>=8.4.0<13.4.7
GitLab GitLab>=13.5.0<13.5.5
GitLab GitLab>=13.5.0<13.5.5
GitLab GitLab>=13.6.0<13.6.2
GitLab GitLab>=13.6.0<13.6.2
Event History
Dec 11, 2020
CVE Published
via MITRE·03:34 AM
Data Sourced
via MITRE·03:34 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-26416?
CVE-2020-26416 has a medium severity rating due to the risk of information disclosure.
2
Which versions of GitLab are affected by CVE-2020-26416?
CVE-2020-26416 affects GitLab versions from 8.4 to 13.4.7, 13.5 to 13.5.5, and 13.6 to 13.6.2.
3
How do I fix CVE-2020-26416?
To address CVE-2020-26416, users should upgrade GitLab to a version above 13.4.7, 13.5.5, or 13.6.2.
4
What type of vulnerability is CVE-2020-26416?
CVE-2020-26416 is categorized as an information disclosure vulnerability.
5
What impact does CVE-2020-26416 have on my data?
CVE-2020-26416 may lead to unintended exposure of sensitive search terms through Rails logs.