Vulnerability Description
An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions.
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 9.5.0, < 12.9.8 |
Related Weaknesses (CWE)
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13263.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/211940Broken Link
- https://hackerone.com/reports/819821Permissions Required
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13263.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/211940Broken Link
- https://hackerone.com/reports/819821Permissions Required
FAQ
What is CVE-2020-13263?
CVE-2020-13263 is a vulnerability with a CVSS score of 7.5 (HIGH). An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perfo...
How severe is CVE-2020-13263?
CVE-2020-13263 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-13263?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab.