CVE-2020-26415

Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API

Medium · published December 11, 2020

CVSS v3.1
4.3
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00825 · 57.0th percentile
Published
2020-12-11T03:29Z
EPSS history
Timeline
  • 11 DEC 03:29Z
    Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API
    cvelistv5