CVE-2020-13272: High severity gitlab vulnerability
Published Jun 19, 2020
·Updated
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow
Affected Software
6 affected components
GitLab GitLab>=12.3.0<12.9.8
GitLab GitLab>=12.3.0<12.9.8
GitLab GitLab>=12.10.0<12.10.7
GitLab GitLab>=12.10.0<12.10.7
GitLab GitLab=13.0.0
GitLab GitLab=13.0.0
Event History
Jun 19, 2020
CVE Published
via MITRE·09:40 PM
Data Sourced
via MITRE·09:40 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-13272?
CVE-2020-13272 is classified as a high severity vulnerability due to its ability to allow unverified users to exploit OAuth authorization flow.
2
How do I fix CVE-2020-13272?
To fix CVE-2020-13272, upgrade to GitLab version 12.10.8 or later, or 13.0.1 or later.
3
Which versions of GitLab are affected by CVE-2020-13272?
CVE-2020-13272 affects GitLab Community and Enterprise editions from version 12.3.0 to 12.10.7 and version 13.0.0.
4
What specific type of attack does CVE-2020-13272 facilitate?
CVE-2020-13272 facilitates an unauthorized OAuth authorization code flow that can lead to account takeover.
5
Is CVE-2020-13272 specific to GitLab or can it be found in other applications?
CVE-2020-13272 is specific to GitLab and its OAuth implementation in the affected versions.