CVE-2020-13346: Medium severity gitlab vulnerability
Published Oct 7, 2020
·Updated
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.
Affected Software
6 affected components
GitLab GitLab>=11.2.0<13.2.10
GitLab GitLab>=11.2.0<13.2.10
GitLab GitLab>=13.3.0<13.3.7
GitLab GitLab>=13.3.0<13.3.7
GitLab GitLab>=13.4.0<13.4.2
GitLab GitLab>=13.4.0<13.4.2
Event History
Oct 7, 2020
CVE Published
via MITRE·01:21 PM
Data Sourced
via MITRE·01:21 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-13346?
CVE-2020-13346 is categorized as a medium severity vulnerability.
2
How do I fix CVE-2020-13346?
To fix CVE-2020-13346, you should upgrade your GitLab installation to version 13.2.10, 13.3.7, or 13.4.2 or later.
3
What does CVE-2020-13346 allow unauthorized access to?
CVE-2020-13346 allows guest users to access confidential issues through the API.
4
Which versions of GitLab are affected by CVE-2020-13346?
CVE-2020-13346 affects GitLab versions prior to 13.2.10, 13.3.7, and 13.4.2.
5
Who is impacted by CVE-2020-13346?
Users of GitLab who are on affected versions may be impacted as guest users could gain unauthorized access.