HIGH

CVE-2020-13299

Gitlab GitLab 2020-09-14 CVSS v3.1

CVSS

8.1

Description

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session.

Summary dbcve.org

In affected GitLab versions (before 13.1.10, 13.2.8, 13.3.4), the session revocation feature fails to properly invalidate all session tokens. An attacker who obtains a previously revoked session token can reuse it to re-establish an authenticated session, effectively bypassing the revocation mechanism.

Mitigation

Upgrade GitLab to version 13.1.10, 13.2.8, 13.3.4 or later to address the incomplete session token revocation.

Weakness (CWE)

CWE-613

EPSS Score

1.23%

Probability of exploitation in next 30 days

67.5th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13299.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/222508 Broken Link https://hackerone.com/reports/896225 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE