CVE-2020-10077: 
GitLab vulnerability analysis and mitigation

CVE-2020-10077 is a Server Side Request Forgery (SSRF) vulnerability affecting GitLab Enterprise Edition (EE) versions 3.0 through 12.8.1. The vulnerability was discovered through an internal investigation which revealed that a deprecated service was creating a server side request forgery risk. The issue was disclosed and patched on March 4, 2020 (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 score of 9.8 (CRITICAL) and a CVSS v2.0 score of 7.5 (HIGH), indicating its severe nature. The vulnerability stems from a deprecated service that could be exploited to perform server-side request forgery attacks (NVD).

The SSRF vulnerability could potentially allow attackers to make unauthorized requests from the server, potentially leading to internal network scanning, data exfiltration, or access to internal services. Given the CRITICAL CVSS score, this vulnerability could have significant security implications for affected GitLab installations (GitLab Release).

GitLab has addressed this vulnerability in version 12.8.2. The recommended mitigation is to upgrade all affected installations to the latest version as soon as possible. This security fix was also backported to versions 12.7.7 and 12.6.8 (GitLab Release).