CVE-2020-6832

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/Release Notes, Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/Release Notes, Vendor Advisory

Timeline

Published: Jan 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-68337.5An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggli CVE-2020-68359.8An issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file-transfer error checking.CVE-2020-68369.8grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails CVE-2020-68389.8In mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash-ext.c.CVE-2020-68399.8In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c.CVE-2020-68409.8In mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c.CVE-2020-68419.8D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyC CVE-2020-68427.2D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in t CVE-2020-68434.8Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.CVE-2020-68448.8In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts.CVE-2020-68456.1An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over CVE-2020-68475.4OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains