CVE-2020-13323: High severity gitlab vulnerability
Published Sep 29, 2020
·Updated
A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos
Affected Software
3 affected components
GitLab GitLab>=8.5.0<12.10.13
GitLab GitLab>=13.0.0<13.0.8
GitLab GitLab>=13.1.0<13.1.2
Event History
Sep 29, 2020
CVE Published
via MITRE·06:29 PM
Data Sourced
via MITRE·06:29 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-13323?
CVE-2020-13323 has a moderate severity level as it affects the confidentiality of private merge requests.
2
How do I fix CVE-2020-13323?
To fix CVE-2020-13323, upgrade GitLab to the latest version that is not affected, specifically versions above 13.1.2.
3
Which GitLab versions are affected by CVE-2020-13323?
CVE-2020-13323 affects GitLab versions prior to 13.1 and several versions including 12.10.13 and 13.0.8.
4
What type of attack does CVE-2020-13323 represent?
CVE-2020-13323 represents a confidentiality attack where private merge requests can be unlawfully accessed.
5
How can I determine if my GitLab instance is vulnerable to CVE-2020-13323?
Check the version of your GitLab instance; if it is between 8.5.0 and 12.10.13 or between 13.0.0 and 13.1.2, it is vulnerable to CVE-2020-13323.