mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-12-30 05:58:39 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
05f89ceffd
commit
26442432f5
@ -4,15 +4,97 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-13288",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=13.0, <13.0.12"
|
||||
},
|
||||
{
|
||||
"version_value": ">=13.1, <13.1.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=13.2, <13.2.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper neutralization of input during web page generation ('cross-site scripting') in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/215538",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/215538",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://hackerone.com/reports/856554",
|
||||
"url": "https://hackerone.com/reports/856554",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13288.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13288.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"version": "3.1",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [@mike12](https://hackerone.com/mike12) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,91 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-13290",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=8.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper access control in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/32291",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/32291",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://hackerone.com/reports/691477",
|
||||
"url": "https://hackerone.com/reports/691477",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13290.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13290.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"version": "3.1",
|
||||
"baseScore": 7.5,
|
||||
"baseSeverity": "HIGH"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [@brdoors3](https://hackerone.com/brdoors3) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,80 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-13291",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=13.2, <13.2.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper access control in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/230521",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/230521",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13291.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13291.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "In GitLab before 13.2.3, project sharing could temporarily allow too permissive access."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"version": "3.1",
|
||||
"baseScore": 8.0,
|
||||
"baseSeverity": "HIGH"
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -68,6 +68,11 @@
|
||||
"refsource": "SUSE",
|
||||
"name": "openSUSE-SU-2020:1164",
|
||||
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.html"
|
||||
},
|
||||
{
|
||||
"refsource": "SUSE",
|
||||
"name": "openSUSE-SU-2020:1182",
|
||||
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -81,6 +81,11 @@
|
||||
"refsource": "FEDORA",
|
||||
"name": "FEDORA-2020-cac5ae9b6e",
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYRKQKUVU45ANH5TFYCYZN6HVP34N3UL/"
|
||||
},
|
||||
{
|
||||
"refsource": "SUSE",
|
||||
"name": "openSUSE-SU-2020:1183",
|
||||
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00023.html"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -61,6 +61,11 @@
|
||||
"name": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1955",
|
||||
"url": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1955",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "MLIST",
|
||||
"name": "[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -61,6 +61,11 @@
|
||||
"name": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1957",
|
||||
"url": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1957",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "MLIST",
|
||||
"name": "[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -61,6 +61,11 @@
|
||||
"name": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1960",
|
||||
"url": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1960",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "MLIST",
|
||||
"name": "[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -61,6 +61,11 @@
|
||||
"name": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1975",
|
||||
"url": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1975",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "MLIST",
|
||||
"name": "[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -57,6 +57,11 @@
|
||||
"name": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20(1)",
|
||||
"url": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20(1)",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "MLIST",
|
||||
"name": "[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -57,6 +57,11 @@
|
||||
"name": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20(2)",
|
||||
"url": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20(2)",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "MLIST",
|
||||
"name": "[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -57,6 +57,11 @@
|
||||
"name": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20(2)",
|
||||
"url": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20(2)",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "MLIST",
|
||||
"name": "[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -57,6 +57,11 @@
|
||||
"name": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1940",
|
||||
"url": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1940",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "MLIST",
|
||||
"name": "[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -61,6 +61,11 @@
|
||||
"name": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1763",
|
||||
"url": "https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1763",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "MLIST",
|
||||
"name": "[oss-security] 20200812 Multiple vulnerabilities in Jenkins and Jenkins plugins",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user