CVE-2020-13268: Infoleak
Published Jun 10, 2020
·Updated
A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1
Affected Software
2 affected components
GitLab GitLab>=12.10.0<=13.0.1
GitLab GitLab>=12.10.0<=13.0.1
Event History
Jun 10, 2020
CVE Published
via MITRE·02:32 PM
Data Sourced
via MITRE·02:32 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-13268?
CVE-2020-13268 is classified as a moderate severity vulnerability.
2
How does CVE-2020-13268 affect GitLab?
CVE-2020-13268 allows an attacker to confirm the existence of files hosted on GitLab's object storage without revealing their contents.
3
Which versions of GitLab are impacted by CVE-2020-13268?
CVE-2020-13268 affects GitLab CE/EE versions 12.10.0 through 13.0.1.
4
How can I remediate CVE-2020-13268?
To fix CVE-2020-13268, upgrade to GitLab version 13.0.2 or later.
5
What types of object storage does CVE-2020-13268 target?
CVE-2020-13268 targets object storage services used by GitLab for managing hosted files.