PT-2020-13437 · Gitlab · Gitlab

Published 2020-09-29 · Updated 2024-03-06 · CVE-2020-13296

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GitLab versions 10.7 through 13.0.13 GitLab versions 13.1.0 through 13.1.7 GitLab versions 13.2.0 through 13.2.5

Description An issue has been discovered in GitLab related to Improper Access Control for Deploy Tokens.

Recommendations For GitLab versions 10.7 through 13.0.13, update to version 13.0.14 or later. For GitLab versions 13.1.0 through 13.1.7, update to version 13.1.8 or later. For GitLab versions 13.2.0 through 13.2.5, update to version 13.2.6 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-GITLAB-2020-13296

CVE-2020-13296

Affected Products

Gitlab

References · 9

• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13296 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13296.json · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13296 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2020-13296 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13296 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13296 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/235996 · Note
• https://hackerone.com/reports/957459 · Note