CVE-2020-10955

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/Release Notes, Vendor Advisory
https://about.gitlab.com/releases/categories/releases/Release Notes, Vendor Advisory
https://www.debian.org/security/2020/dsa-4691Third Party Advisory
https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/Release Notes, Vendor Advisory
https://about.gitlab.com/releases/categories/releases/Release Notes, Vendor Advisory
https://www.debian.org/security/2020/dsa-4691Third Party Advisory

Timeline

Published: Mar 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-109569.8GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.CVE-2020-109577.5In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in CVE-2020-109585.3In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or l CVE-2020-109596.1resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via CVE-2020-10964.2A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could co CVE-2020-109605.3In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in CVE-2020-109627.8In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability in the default config CVE-2020-109637.2FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_imag CVE-2020-109649.8Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a CVE-2020-109658.1Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the d CVE-2020-109666.5In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads t CVE-2020-109675.3In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpar