CVE-2020-13355
published 2020-11-19CVE-2020-13355: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to…
PriorityP346high8.1CVSS 3.1
AVNACLPRLUINSUCNIHAH
EPSS
1.66%
73.7th percentile
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, =13.4, =13.5, <13.5.2.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 13.3.9-1 (sid) | gitlab 13.3.9-1 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 13.4.0 < 13.4.5 | 13.4.5 |
| gitlab | gitlab | >= 13.5.0 < 13.5.2 | 13.5.2 |
| gitlab | gitlab | >= 8.14.0 < 13.3.9 | 13.3.9 |
| gitlab | gitlab_ce | — | — |
| gitlab | gitlab_ce_ee | — | — |
| gitlab | gitlab_ce_ee | — | — |
| gitlab | gitlab_ce_ee | — | — |
| gitlab | gitlab_ce_ee | — | — |
| gitlab | gitlab_ce_ee | — | — |
| gitlab | gitlab_ce_ee | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:P
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j76w-jg9r-w5vr: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8
ghsa_unreviewed·2022-05-24
CVE-2020-13355 [HIGH] CWE-22 GHSA-j76w-jg9r-w5vr: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, =13.4, =13.5, <13.5.2.
GitLab
CVE-2020-13355: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker t
vendor_gitlab·2020-11-19·CVSS 7.5
CVE-2020-13355 [HIGH] CWE-22 CVE-2020-13355: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker t
CVE-2020-13355: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, =13.4, =13.5, <13.5.2.
Debian
CVE-2020-13355: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro...
vendor_debian·2020·CVSS 7.5
CVE-2020-13355 [HIGH] CVE-2020-13355: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro...
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, =13.4, =13.5, <13.5.2.
Scope: local
sid: resolved (fixed in 13.3.9-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13355.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/255886https://hackerone.com/reports/990800https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13355.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/255886https://hackerone.com/reports/990800
2020-11-19
Published