CVE-2020-26407
Severity Score
5.4
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project
Se presenta una vulnerabilidad de tipo XSS en Gitlab CE/EE desde versiones 12.4 anteriores a 13.4.7, versiones 13.5 anteriores a 13.5.5 y versiones 13.6 anteriores a 13.6.2, que permite a un atacante llevar a cabo ataques de tipo cross-site scripting para otros usuarios por medio de la importación de un proyecto malicioso.
*Credits:
Thanks (@vakzz)[https://hackerone.com/vakzz] for reporting this vulnerability through our HackerOne bug bounty program
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-10-01 CVE Reserved
- 2020-12-10 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26407.json | Third Party Advisory | |
| https://gitlab.com/gitlab-org/gitlab/-/issues/212630 | Broken Link |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 12.4.0 < 13.4.7 Search vendor "Gitlab" for product "Gitlab" and version " >= 12.4.0 < 13.4.7" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 12.4.0 < 13.4.7 Search vendor "Gitlab" for product "Gitlab" and version " >= 12.4.0 < 13.4.7" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 13.5.0 < 13.5.5 Search vendor "Gitlab" for product "Gitlab" and version " >= 13.5.0 < 13.5.5" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 13.5.0 < 13.5.5 Search vendor "Gitlab" for product "Gitlab" and version " >= 13.5.0 < 13.5.5" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 13.6.0 < 13.6.2 Search vendor "Gitlab" for product "Gitlab" and version " >= 13.6.0 < 13.6.2" | community |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 13.6.0 < 13.6.2 Search vendor "Gitlab" for product "Gitlab" and version " >= 13.6.0 < 13.6.2" | enterprise |
Affected
| ||||||