CVE-2020-13352: Medium severity gitlab vulnerability
Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-13352?
CVE-2020-13352 is considered a medium severity vulnerability due to the potential exposure of sensitive group information.
How do I fix CVE-2020-13352?
To fix CVE-2020-13352, upgrade to GitLab versions 13.3.9, 13.4.5, or 13.5.2 or later, ensuring that private group settings are preserved during migration.
Which GitLab versions are affected by CVE-2020-13352?
CVE-2020-13352 affects GitLab CE/EE versions from 10.2 to below 13.3.9, and also versions between 13.4 and below 13.4.5, as well as 13.5 to below 13.5.2.
What data is exposed in CVE-2020-13352?
CVE-2020-13352 results in the leakage of private group information when a project transitions from a private to a public group.
Is there a workaround for CVE-2020-13352?
The primary recommendation is to avoid changing project visibility settings from private to public in affected versions until an update can be applied.