CVE-2020-11505
Last modified
CVE-2020-11505 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling.. EPSS estimates a 1.17% chance of exploitation in the next 30 days.
Description
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | < 12.7.9 |
| Gitlab | Gitlab | >= 12.8.0, < 12.8.9 |
| Gitlab | Gitlab | >= 12.9.0, < 12.9.3 |
References
- https://about.gitlab.com/blog/categories/releases/Vendor Advisory
- https://about.gitlab.com/blog/categories/releases/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-11505?
How severe is CVE-2020-11505?
How do I fix CVE-2020-11505?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-11498Slack Nebula through 1.1.0 contains a relative path vulnerab…8.8
- CVE-2020-11499Firmware Analysis and Comparison Tool (FACT) 3 has Stored XS…6.1
- CVE-2020-1150A memory corruption vulnerability exists when Windows Media …7.8
- CVE-2020-11500Zoom Client for Meetings through 4.6.9 uses the ECB mode of …7.5
- CVE-2020-11501GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for D…7.4
- CVE-2020-11503A heap-based buffer overflow in the awarrensmtp component of…9.8
- CVE-2020-11506An issue was discovered in GitLab 10.7.0 and later through 1…7.5
- CVE-2020-11507An Untrusted Search Path vulnerability in Malwarebytes AdwCl…7.8
- CVE-2020-11508An XSS vulnerability in the WP Lead Plus X plugin through 0.…5.4
- CVE-2020-11509An XSS vulnerability in the WP Lead Plus X plugin through 0.…6.1
- CVE-2020-1151An elevation of privilege vulnerability exists when the Wind…7.8
- CVE-2020-11511The LearnPress plugin before 3.2.6.9 for WordPress allows re…8.1
Are you affected by CVE-2020-11505?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST