CVE-2020-1948: Deserialization of Untrusted Data

July 14, 2020 (updated July 21, 2020)

An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code.

References

nvd.nist.gov/vuln/detail/CVE-2020-1948

Code Behaviors & Features

Detect and mitigate CVE-2020-1948 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →