CVE-2020-13334: High severity GitLab GitLab vulnerability

Q: What is the severity of CVE-2020-13334?

CVE-2020-13334 has been classified as a medium severity vulnerability due to improper authorization checks.

Q: How do I fix CVE-2020-13334?

To fix CVE-2020-13334, upgrade GitLab to version 13.2.10, 13.3.7, or 13.4.2 or later.

Q: What versions of GitLab are affected by CVE-2020-13334?

CVE-2020-13334 affects GitLab versions prior to 13.2.10, 13.3.7, and 13.4.2.

Q: What type of vulnerability is CVE-2020-13334?

CVE-2020-13334 is an authorization vulnerability that allows non-members of a project/group to change issue confidentiality.

Q: Can CVE-2020-13334 lead to data exposure?

Yes, CVE-2020-13334 can potentially lead to unauthorized changes in issue confidentiality, resulting in data exposure.

Published Oct 7, 2020

Updated

In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query

Affected Software

6 affected components

GitLab GitLab>=8.6.0<13.2.10

GitLab GitLab>=13.3.0<13.3.7

GitLab GitLab>=13.4.0<13.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GitLab to a version that resolves this vulnerability.
Fixed in 13.2.10
Upgrade
Upgrade GitLab to a version that resolves this vulnerability.
Fixed in 13.3.7
Upgrade
Upgrade GitLab to a version that resolves this vulnerability.
Fixed in 13.4.2

Event History

Oct 7, 2020

CVE Published

via MITRE·01:18 PM

Data Sourced

via MITRE·01:18 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·02:15 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2020-13334?

CVE-2020-13334 has been classified as a medium severity vulnerability due to improper authorization checks.

How do I fix CVE-2020-13334?