CVE-2020-13344: Medium severity gitlab vulnerability
Published Oct 8, 2020
·Updated
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis
Affected Software
6 affected components
GitLab GitLab>=10.8.0<13.2.10
GitLab GitLab>=10.8.0<13.2.10
GitLab GitLab>=13.3.0<13.3.7
GitLab GitLab>=13.3.0<13.3.7
GitLab GitLab>=13.4.0<13.4.2
GitLab GitLab>=13.4.0<13.4.2
Event History
Oct 8, 2020
CVE Published
via MITRE·01:43 PM
Data Sourced
via MITRE·01:43 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-13344?
CVE-2020-13344 is considered a medium severity vulnerability due to session keys being stored in plain-text in Redis.
2
How do I fix CVE-2020-13344?
To fix CVE-2020-13344, upgrade GitLab to versions 13.2.10, 13.3.7, or 13.4.2 or later.
3
What versions are affected by CVE-2020-13344?
CVE-2020-13344 affects all GitLab versions prior to 13.2.10, 13.3.7, and 13.4.2.
4
What type of access is required for an attacker to exploit CVE-2020-13344?
An attacker needs access to Redis to exploit CVE-2020-13344 and authenticate as any user with stored sessions.
5
Is CVE-2020-13344 relevant to both community and enterprise editions of GitLab?
Yes, CVE-2020-13344 is relevant to both the community and enterprise editions of GitLab.