HIGH

CVE-2020-13270

Gitlab GitLab 2020-06-10 CVSS v3.1

CVSS

8.8

Description

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API

Summary dbcve.org

Missing authorization check in GitLab's API allows guest users to create fork relations on restricted public projects. Guest users, who should have read-only or no access to private content, can exploit the fork relation API endpoint to establish fork relationships on projects that should be restricted.

Mitigation

Upgrade GitLab to version 13.0.2 or later. Alternatively, implement API request filtering at the gateway layer to block fork relation API calls from unauthenticated or guest-level users until the upgrade can be performed.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

1.41%

Probability of exploitation in next 30 days

71.5th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13270.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/24648 Broken Link, Vendor Advisory https://hackerone.com/reports/419977 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE