CVE-2020-10087: 
GitLab vulnerability analysis and mitigation

CVE-2020-10087 is a security vulnerability affecting GitLab that was disclosed on March 4, 2020. The vulnerability relates to badge images not being properly proxied in GitLab, which affected all versions of GitLab prior to version 12.8.2. This information disclosure vulnerability impacted both GitLab Community Edition (CE) and Enterprise Edition (EE) (GitLab Release).

The vulnerability stems from badge images not being proxied correctly in GitLab's implementation. This technical oversight resulted in mixed content warnings and exposed user IP addresses. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (HIGH) and a CVSS v2.0 score of 5.0 (MEDIUM), indicating its significant security impact (NVD Results).

The primary impact of this vulnerability was the unintended disclosure of user IP addresses through badge images, potentially compromising user privacy and security. Additionally, the vulnerability caused mixed content warnings in web browsers, which could affect the user experience and potentially expose users to other security risks (GitLab Release).

The vulnerability was addressed in GitLab version 12.8.2, and the fix was also backported to versions 12.7.7 and 12.6.8. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version as soon as possible to mitigate this security risk (GitLab Release).