CVE-2020-11021: Information Exposure

April 29, 2020 (updated September 14, 2021)

Actions Http-Client can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: make an http request with an authorization header that request leads to a redirect (302) the redirect url redirects to another domain or hostname. Consequently, the authorization header will get passed to the other domain.

References

nvd.nist.gov/vuln/detail/CVE-2020-11021

Code Behaviors & Features

Detect and mitigate CVE-2020-11021 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →