CVE-2020-13344: Medium severity GitLab GitLab vulnerability
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 13.2.10 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 13.3.7 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 13.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-13344?
CVE-2020-13344 is considered a medium severity vulnerability due to session keys being stored in plain-text in Redis.
How do I fix CVE-2020-13344?
To fix CVE-2020-13344, upgrade GitLab to versions 13.2.10, 13.3.7, or 13.4.2 or later.
What versions are affected by CVE-2020-13344?
CVE-2020-13344 affects all GitLab versions prior to 13.2.10, 13.3.7, and 13.4.2.
What type of access is required for an attacker to exploit CVE-2020-13344?
An attacker needs access to Redis to exploit CVE-2020-13344 and authenticate as any user with stored sessions.
Is CVE-2020-13344 relevant to both community and enterprise editions of GitLab?
Yes, CVE-2020-13344 is relevant to both the community and enterprise editions of GitLab.