MEDIUM

CVE-2020-13297

Gitlab GitLab 2020-09-14 CVSS v3.1

CVSS

5.4

Description

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint.

Summary dbcve.org

GitLab versions before 13.1.10, 13.2.8, and 13.3.4 contain a 2FA bypass vulnerability in group authentication. When two-factor authentication is enabled for groups, a malicious user can circumvent this protection by sending a specific query to the API endpoint, allowing unauthorized access without completing 2FA.

Mitigation

Upgrade GitLab to version 13.1.10, 13.2.8, 13.3.4 or later. Before production deployment, test the upgrade in a staging environment to verify 2FA group restrictions function correctly.

EPSS Score

1.03%

Probability of exploitation in next 30 days

62.2th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13297.json Third Party Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/32215 Broken Link https://hackerone.com/reports/691592 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE