CVE-2020-6833

Description

An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling.

How to fix CVE-2020-6833

To remediate CVE-2020-6833, upgrade the affected package to a fixed version below.

• Bitnami/gitlab—upgrade to 12.5.9 or later

Is CVE-2020-6833 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 11.3.0, < 12.5.9, >= 12.6.0, < 12.6.6, >= 12.7.2, < 12.7.4

CVSS scores

References (3)

• WEBabout.gitlab.com/blog/categories/releases/
• WEBabout.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
• WEBnvd.nist.gov/vuln/detail/CVE-2020-6833