CVE-2020-13335 — Incorrect Authorization in Gitlab

CWE-863 — Incorrect AuthorizationCWE-287 — Improper Authentication5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 64.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedOct 7
Latest updateMay 24

Description

Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their group.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDgitlab/gitlab7.12.0 — 13.2.10+2
▶debiandebian/gitlab< gitlab 13.2.10-1 (sid)
▶CVEListV5gitlab/gitlab>=13.3.0, <13.3.7, >=13.4.0, <13.4.2, >=7.12, <13.2.10+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-jcwq-43pm-wp74: Improper group membership validation when deleting a user account in GitLab >=7↗2022-05-24
▶
OSV
CVE-2020-13335: Improper group membership validation when deleting a user account in GitLab >=7↗2020-10-07
▶

📋Vendor Advisories

2
GitLab
CVE-2020-13335: Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring t↗2020-10-07
▶
Debian
CVE-2020-13335: gitlab - Improper group membership validation when deleting a user account in GitLab >=7....↗2020
▶