GitLab Enterprise Edition up to 13.0.1 Project Maintainer Impersonation privileges management

entryeditHistoryDiffjsonxmlCTI

A vulnerability was found in GitLab Enterprise Edition up to 13.0.1 (Bug Tracking Software). It has been declared as critical. Affected by this vulnerability is an unknown code block of the component Project Maintainer Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
10561539	10/26/2020	VulD...	cve_cna	GitLab Inc.	nvd.nist.gov	10/26/2020	accepted	70
10561538	10/26/2020	VulD...	confirm_url	https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13263.json	cve.mitre.org	10/26/2020	accepted	70
10189736	06/21/2020	VulD...	cwe	269 (privilege escalation)		06/21/2020	accepted	90
10189735	06/21/2020	VulD...	cve_nvd_summary	An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions.	mitre.org	06/21/2020	accepted	100
10189734	06/21/2020	VulD...	cve_assigned	1590019200	mitre.org	06/21/2020	accepted	100
10189728	06/21/2020	VulD...	cvss3_nvd_a	H	nist.gov	06/21/2020	accepted	100
10189727	06/21/2020	VulD...	cvss3_nvd_i	H	nist.gov	06/21/2020	accepted	100
10189726	06/21/2020	VulD...	cvss3_nvd_c	H	nist.gov	06/21/2020	accepted	100
10189725	06/21/2020	VulD...	cvss3_nvd_s	U	nist.gov	06/21/2020	accepted	100
10189724	06/21/2020	VulD...	cvss3_nvd_ui	N	nist.gov	06/21/2020	accepted	100
10189723	06/21/2020	VulD...	cvss3_nvd_pr	L	nist.gov	06/21/2020	accepted	100
10189722	06/21/2020	VulD...	cvss3_nvd_ac	H	nist.gov	06/21/2020	accepted	100
10189721	06/21/2020	VulD...	cvss3_nvd_av	N	nist.gov	06/21/2020	accepted	100
10189695	06/21/2020	VulD...	type	Bug Tracking Software		06/21/2020	accepted	100
10189744	06/21/2020	VulD...	cvss3_nvd_basescore	7.5	nist.gov	06/21/2020	accepted	90
10189743	06/21/2020	VulD...	cvss3_vuldb_rc	X		06/21/2020	accepted	90
10189742	06/21/2020	VulD...	cvss3_vuldb_rl	X		06/21/2020	accepted	90
10189741	06/21/2020	VulD...	cvss3_vuldb_e	X		06/21/2020	accepted	90
10189740	06/21/2020	VulD...	cvss2_vuldb_rc	ND		06/21/2020	accepted	90
10189739	06/21/2020	VulD...	cvss2_vuldb_rl	ND		06/21/2020	accepted	90