CVE Vulnerabilities

CVE-2020-13353

Insufficient Session Expiration

Published: Nov 17, 2020 | Modified: Jun 13, 2022
CVSS 3.x
3.2
LOW
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS 2.x
2.1 LOW
AV:L/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.

Weakness

According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”

Affected Software

Name Vendor Start Version End Version
Gitaly Gitlab 13.5.0 *
Gitaly Gitlab 13.4.0 *
Gitaly Gitlab 1.79.0 *

Potential Mitigations

References