CVE-2020-13313
published 2020-09-14CVE-2020-13313: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.98%
57.9th percentile
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 13.2.8-1 (sid) | gitlab 13.2.8-1 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 13.1.0 < 13.1.10 | 13.1.10 |
| gitlab | gitlab | >= 13.2.0 < 13.2.8 | 13.2.8 |
| gitlab | gitlab | >= 13.3.0 < 13.3.4 | 13.3.4 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2020-13313: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges
vendor_gitlab·2020-09-14·CVSS 4.3
CVE-2020-13313 [MEDIUM] CWE-863 CVE-2020-13313: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges
CVE-2020-13313: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control.
Debian
CVE-2020-13313: gitlab - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13....
vendor_debian·2020·CVSS 4.3
CVE-2020-13313 [MEDIUM] CVE-2020-13313: gitlab - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13....
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control.
Scope: local
sid: resolved (fixed in 13.2.8-1)
GHSA
GHSA-rg23-p49x-87gc: A vulnerability was discovered in GitLab versions before 13
ghsa_unreviewed·2022-05-24
CVE-2020-13313 [MEDIUM] GHSA-rg23-p49x-87gc: A vulnerability was discovered in GitLab versions before 13
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control.
OSV
CVE-2020-13313: A vulnerability was discovered in GitLab versions before 13
osv·2020-09-14·CVSS 4.3
CVE-2020-13313 [MEDIUM] CVE-2020-13313: A vulnerability was discovered in GitLab versions before 13
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13313.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/118536https://hackerone.com/reports/751264https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13313.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/118536https://hackerone.com/reports/751264
2020-09-14
Published