CVE-2020-11649

Description

An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted.

How to fix CVE-2020-11649

To remediate CVE-2020-11649, upgrade the affected package to a fixed version below.

• Bitnami/gitlab—upgrade to 12.7.9 or later

Is CVE-2020-11649 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 8.15.0, < 12.7.9, >= 12.8.0, < 12.8.9, >= 12.9.0, < 12.9.3

CVSS scores

References (3)

• WEBabout.gitlab.com/blog/categories/releases/
• WEBabout.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/
• WEBnvd.nist.gov/vuln/detail/CVE-2020-11649