CVE-2020-13276: High severity gitlab vulnerability
Published Jun 19, 2020
·Updated
User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1
Affected Software
6 affected components
GitLab GitLab<12.9.8
GitLab GitLab<12.9.8
GitLab GitLab>=12.10.0<12.10.7
GitLab GitLab>=12.10.0<12.10.7
GitLab GitLab=13.0.0
GitLab GitLab=13.0.0
Event History
Jun 19, 2020
CVE Published
via MITRE·09:37 PM
Data Sourced
via MITRE·09:37 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-13276?
CVE-2020-13276 is classified as a high severity vulnerability due to the potential for unauthorized email notifications.
2
How do I fix CVE-2020-13276?
To mitigate CVE-2020-13276, upgrade to GitLab version 12.10.8 or later, or 13.0.1 or later.
3
What versions are affected by CVE-2020-13276?
CVE-2020-13276 affects GitLab versions prior to 12.10.8 and 13.0.1.
4
What does CVE-2020-13276 exploit?
CVE-2020-13276 exploits the ability for users to set notification emails without email verification.
5
Is there a workaround for CVE-2020-13276?
There is no official workaround for CVE-2020-13276; upgrading to a secure version is the recommended action.