Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.
Weakness
The product does not properly “clean up” and remove temporary or supporting resources after they have been used.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 11.2.0 (including) | 13.2.10 (excluding) |
| Gitlab | Gitlab | 13.3.0 (including) | 13.3.7 (excluding) |
| Gitlab | Gitlab | 13.4.0 (including) | 13.4.2 (excluding) |
| Gitlab | Ubuntu | esm-apps/xenial | * |
| Gitlab | Ubuntu | xenial | * |
Potential Mitigations
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13346.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/219496
- https://hackerone.com/reports/880863
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13346.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/219496
- https://hackerone.com/reports/880863