MEDIUM

CVE-2020-13303

Gitlab GitLab 2020-09-15 CVSS v3.1

CVSS

6.5

Description

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private repository within a public project.

Summary dbcve.org

GitLab versions before 13.1.10, 13.2.8, and 13.3.4 contain an authorization bypass where improper permission verification allows unauthorized users to access private repositories nested within public projects. This enables attackers to read sensitive private code they should not have access to.

Mitigation

Upgrade GitLab to version 13.1.10, 13.2.8, 13.3.4 or later. Prior to upgrading, assess the current version and plan for appropriate backup and downtime.

Weakness (CWE)

CWE-287 Improper Authentication

EPSS Score

1.16%

Probability of exploitation in next 30 days

65.8th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13303.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/238887 Broken Link https://hackerone.com/reports/962231 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE