PT-2020-7505 · Gitlab · Gitlab Ce/Ee+2

Joernchen · Published 2020-01-28 · Updated 2020-02-03 · CVE-2013-4583

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: GitLab versions 5.0 through 5.4.2 GitLab Community Edition versions 5.0 through 6.2.4 GitLab Enterprise Edition versions 5.0 through 6.2.1 gitlab-shell versions prior to 1.7.8

Description: The issue allows remote authenticated users to gain privileges and clone arbitrary repositories due to a problem in the parse cmd function.

Recommendations: For GitLab versions 5.0 through 5.4.2, update to version 5.4.2 or later. For GitLab Community Edition versions 5.0 through 6.2.4, update to version 6.2.4 or later. For GitLab Enterprise Edition versions 5.0 through 6.2.1, update to version 6.2.1 or later. For gitlab-shell versions prior to 1.7.8, update to version 1.7.8 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2013-4583

Affected Products

Gitlab

Gitlab Ce/Ee

Gitlab-Shell

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-4583 · Security Note
• https://openwall.com/lists/oss-security/2013/11/18/4 · Patch
• https://gitlab.com/2013/11/14/multiple-critical-vulnerabilities-in-gitlab · Note
• https://t.me/cvenotify/520 · Telegram Post
• http://openwall.com/lists/oss-security/2013/11/15/4 · Note