PT-2020-13449 · Gitlab · Gitlab

Published 2020-09-15 · Updated 2024-03-06 · CVE-2020-13308

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4

Description A vulnerability was discovered that could prohibit a user without 2 factor authentication enabled from accessing GitLab if they are invited into a project that has 2 factor authentication inheritance.

Recommendations For versions prior to 13.1.10, update to version 13.1.10 or later. For versions prior to 13.2.8, update to version 13.2.8 or later. For versions prior to 13.3.4, update to version 13.3.4 or later.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

BIT-GITLAB-2020-13308

CVE-2020-13308

Affected Products

Gitlab

References · 10

• https://cve.org/CVERecord?id=CVE-2020-13308 · Security Note
• https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13308.json · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13308 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13308 · Security Note
• https://ubuntu.com/security/CVE-2020-13308 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2020-13308 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/29989 · Note
• https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released · Note
• https://hackerone.com/reports/637675 · Note