CVE-2020-13323 — Incorrect Authorization in Gitlab

CWE-863 — Incorrect Authorization5 documents5 sources

Severity

7.7HIGHNVD

EPSS

0.1%

top 69.69%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gitlab Debian Gitlab

Timeline

PublishedSep 30

Latest updateMay 24

Description

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 3.1 | Impact: 4.0

Affected Packages4 packages

▶NVDgitlab/gitlab8.5.0 — 12.10.13+2

▶debiandebian/gitlab< gitlab 13.2.3-2 (sid)

▶CVEListV5gitlab/gitlab>=13.0, <13.0.8, >=13.1, <13.1.2, >=8.5, <12.10.13+2

▶gitlabgitlab/gitlab

🔴Vulnerability Details

GHSA

GHSA-mrc8-h5gc-pvrr: A vulnerability was discovered in GitLab versions prior 13↗2022-05-24

▶

OSV

CVE-2020-13323: A vulnerability was discovered in GitLab versions prior 13↗2020-09-30

▶

📋Vendor Advisories

GitLab

CVE-2020-13323: A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos↗2020-09-30

▶

Debian

CVE-2020-13323: gitlab - A vulnerability was discovered in GitLab versions prior 13.1. Under certain cond...↗2020

▶