CVE-2020-10073

Vulnerability

A denial of service vulnerability exists in GitLab EE versions 12.4.2 through 12.8.1. The issue is triggered by permissions checks performed when loading a project home page, leading to excessive resource consumption. The vulnerability was internally discovered and does not require any special configuration beyond a standard GitLab EE deployment [1].

Exploitation

An attacker with access to a project (e.g., any authenticated user) can cause a denial of service by repeatedly or specifically interacting with the project home page in a way that triggers the vulnerable permission checks. The exact sequence of steps has not been publicly disclosed, but the attack vector is network-based and requires no special privileges beyond being able to view the project [1].

Impact

Successful exploitation results in a denial of service, making the affected project home page unresponsive or slow for legitimate users. No data confidentiality or integrity is compromised; the impact is limited to availability [1].

Mitigation

The vulnerability is fixed in GitLab EE version 12.8.2, released on 2020-03-04 [1]. Users should upgrade to this version or later. No workarounds have been provided by the vendor.