CVE-2020-13299: High severity GitLab GitLab vulnerability

Q: What is the severity of CVE-2020-13299?

CVE-2020-13299 is classified as a medium severity vulnerability due to its potential for session token reuse.

Q: How do I fix CVE-2020-13299?

To fix CVE-2020-13299, upgrade GitLab to versions 13.1.10, 13.2.8, or 13.3.4 or later.

Q: What systems are affected by CVE-2020-13299?

CVE-2020-13299 affects GitLab community and enterprise editions prior to versions 13.1.10, 13.2.8, and 13.3.4.

Q: What type of vulnerability is CVE-2020-13299?

CVE-2020-13299 is a session management vulnerability that allows reuse of session tokens.

Q: When was CVE-2020-13299 disclosed?

CVE-2020-13299 was disclosed in 2020 as part of the security updates for GitLab.

Published Sep 14, 2020

Updated

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session.

Affected Software

6 affected components

GitLab GitLab>=13.1.0<13.1.10

GitLab GitLab>=13.2.0<13.2.8

GitLab GitLab>=13.3.0<13.3.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GitLab to a version that resolves this vulnerability.
Fixed in 13.1.10
Upgrade
Upgrade GitLab to a version that resolves this vulnerability.
Fixed in 13.2.8
Upgrade
Upgrade GitLab to a version that resolves this vulnerability.
Fixed in 13.3.4

Event History

Sep 14, 2020

CVE Published

via MITRE·06:36 PM

Data Sourced

via MITRE·06:36 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·07:15 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2020-13299?

CVE-2020-13299 is classified as a medium severity vulnerability due to its potential for session token reuse.

How do I fix CVE-2020-13299?