p PatchFirst

CVE-2020-13346

CVE-2020-13346

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.

CVSS 6.5 · Medium · EPSS 1.3%

Published
Updated

Stack: system

Affected products and versions

  • gitlab

    Versions
    • >=11.2, <13.2.10: Affected
    • >=13.3.0, <13.3.7: Affected
    • >=13.4.0, <13.4.2: Affected

    No fix published

  • gitlab Ubuntu:16.04:LTS

    Versions
    • 8.4.3+dfsg-9
    • 8.4.3+dfsg-12
    • 8.5.8+dfsg-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →