Information disclosure

2020-01-2816:15:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

53.0%

JSON

The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.

CPENameOperatorVersion
gitlabge6.0.0
gitlablt6.2.4
gitlabge6.0.0
gitlablt6.2.1
gitlabge5.0.0
gitlablt5.4.2
gitlab-shelllt1.7.8

Name	Operator	Version
gitlab	ge	6.0.0
gitlab	lt	6.2.4
gitlab	ge	6.0.0
gitlab	lt	6.2.1
gitlab	ge	5.0.0
gitlab	lt	5.4.2
gitlab-shell	lt	1.7.8

References

www.openwall.com/lists/oss-security/2013/11/15/4

www.gitlab.com/2013/11/14/multiple-critical-vulnerabilities-in-gitlab/

www.openwall.com/lists/oss-security/2013/11/18/4