CVE-2020-26417: Infoleak
Published Dec 11, 2020
·Updated
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
Affected Software
6 affected components
GitLab GitLab>=13.1.0<13.4.7
GitLab GitLab>=13.1.0<13.4.7
GitLab GitLab>=13.5.0<13.5.5
GitLab GitLab>=13.5.0<13.5.5
GitLab GitLab>=13.6.0<13.6.2
GitLab GitLab>=13.6.0<13.6.2
Event History
Dec 11, 2020
CVE Published
via MITRE·03:37 AM
Data Sourced
via MITRE·03:37 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-26417?
CVE-2020-26417 is considered a medium severity vulnerability due to its potential for information disclosure.
2
How do I fix CVE-2020-26417?
To fix CVE-2020-26417, upgrade GitLab versions to at least 13.6.2, 13.5.5, or 13.4.7 or later.
3
What software is affected by CVE-2020-26417?
CVE-2020-26417 affects GitLab CE and EE versions between 13.1.0 and 13.4.7, 13.5.0 and 13.5.5, as well as 13.6.0 and 13.6.2.
4
What type of information does CVE-2020-26417 expose?
CVE-2020-26417 exposes private group and project membership information.
5
What is the impact of CVE-2020-26417?
The impact of CVE-2020-26417 is the potential unauthorized access to sensitive membership details within private projects and groups.