Vulnerability Description
An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 9.4.0, < 11.4.13 |
Related Weaknesses (CWE)
References
- https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-releaRelease NotesVendor Advisory
- https://about.gitlab.com/blog/categories/releases/Release NotesVendor Advisory
- https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-releaRelease NotesVendor Advisory
- https://about.gitlab.com/blog/categories/releases/Release NotesVendor Advisory
FAQ
What is CVE-2018-20500?
CVE-2018-20500 is a vulnerability with a CVSS score of 7.5 (HIGH). An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token ...
How severe is CVE-2018-20500?
CVE-2018-20500 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-20500?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab.