description: When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
problem types: Cleartext storage of sensitive information in Gitaly
affected:
{
product: Gitaly
vendor: GitLab
versions:
status: affected, version: >=1.79.0, <13.3.9
status: affected, version: >=13.4, <13.4.5
status: affected, version: >=13.5, <13.5.2
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
version: 3.1
]