GitLab up to 13.0.13/13.1.7/13.2.5 Access Control privileges management

Summaryinfo

A vulnerability marked as critical has been reported in GitLab up to 13.0.13/13.1.7/13.2.5. Affected by this issue is some unknown functionality of the component Access Control. Performing a manipulation results in privileges management. This vulnerability is known as CVE-2020-13296. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in GitLab up to 13.0.13/13.1.7/13.2.5 (Bug Tracking Software). This affects an unknown code of the component Access Control. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens

The weakness was published 09/30/2020 (Website). It is possible to read the advisory at gitlab.com. This vulnerability is uniquely identified as CVE-2020-13296 since 05/21/2020. It is possible to initiate the attack remotely. A authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 13.0.14, 13.1.8 or 13.2.6 eliminates this vulnerability.

Similar entries are available at VDB-162079, VDB-162078, VDB-162077 and VDB-162076. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Bug Tracking Software

Name

• GitLab

Version

• 13.0.0
• 13.0.1
• 13.0.2
• 13.0.3
• 13.0.4
• 13.0.5
• 13.0.6
• 13.0.7
• 13.0.8
• 13.0.9
• 13.0.10
• 13.0.11
• 13.0.12
• 13.0.13
• 13.1.0
• 13.1.1
• 13.1.2
• 13.1.3
• 13.1.4
• 13.1.5
• 13.1.6
• 13.1.7
• 13.2.0
• 13.2.1
• 13.2.2
• 13.2.3
• 13.2.4
• 13.2.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion