CVE-2020-8902: Server-Side Request Forgery (SSRF)

February 23, 2021 (updated February 26, 2021)

An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot.

References

nvd.nist.gov/vuln/detail/CVE-2020-8902

Code Behaviors & Features

Detect and mitigate CVE-2020-8902 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →