CVE-2020-13346: Medium severity GitLab GitLab vulnerability
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 13.2.10 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 13.3.7 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 13.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-13346?
CVE-2020-13346 is categorized as a medium severity vulnerability.
How do I fix CVE-2020-13346?
To fix CVE-2020-13346, you should upgrade your GitLab installation to version 13.2.10, 13.3.7, or 13.4.2 or later.
What does CVE-2020-13346 allow unauthorized access to?
CVE-2020-13346 allows guest users to access confidential issues through the API.
Which versions of GitLab are affected by CVE-2020-13346?
CVE-2020-13346 affects GitLab versions prior to 13.2.10, 13.3.7, and 13.4.2.
Who is impacted by CVE-2020-13346?
Users of GitLab who are on affected versions may be impacted as guest users could gain unauthorized access.