HIGH

CVE-2020-13296

Gitlab GitLab 2020-09-30 CVSS v3.1

CVSS

8.8

Description

An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens

Summary dbcve.org

GitLab versions prior to 13.0.14, 13.1.8, and 13.2.6 contain an improper access control vulnerability in the Deploy Tokens feature. Deploy tokens, which are designed for CI/CD pipeline authentication to repositories and container registries, could be used to access resources beyond their intended scope due to insufficient access control enforcement.

Mitigation

Upgrade GitLab to version 13.0.14, 13.1.8, 13.2.6 or later. Review existing deploy tokens and rotate any that may have been created during affected versions to ensure no unauthorized access occurred.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

1.6%

Probability of exploitation in next 30 days

74.7th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13296.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/235996 Broken Link https://hackerone.com/reports/957459 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE