CVE-2020-13293

Summary dbcve.org

In GitLab versions prior to 13.0.12, 13.1.6, and 13.2.3, branch names containing hexadecimal characters could be mishandled due to confusion between branch references and commit SHA hashes (which are also hexadecimal). This allowed an attacker to create or manipulate a branch with a hexadecimal name to override or shadow an existing hash reference, potentially leading to reference confusion or redirect attacks.

Mitigation

Upgrade GitLab to version 13.0.12, 13.1.6, 13.2.3, or later. Additionally, review existing branches with hexadecimal names for potential abuse and implement branch naming policies to prevent future issues.