CVE-2020-13321 : A vulnerability was discovered in GitLab versions prior to 13.1. Username format

A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added.

Published 2020-09-30 18:15:19

Updated 2020-10-02 17:33:28

Source GitLab Inc.

View at NVD, CVE.org

Products affected by CVE-2020-13321

Gitlab » Gitlab
Versions from including (>=) 13.0.0 and before (<) 13.0.8
cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab
Versions from including (>=) 13.1.0 and before (<) 13.1.2
cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Matching versions
Gitlab » Gitlab
Versions before (<) 12.10.13
cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 40 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L	2.8	5.5	GitLab Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: Low
8.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L	2.8	5.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: Low

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13321.json

2020/CVE-2020-13321.json · master · GitLab.org / cves · GitLab
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/25751

Add <a href=> into our name and bypass "//" being used in URL to create a valid URL + custom image on snippets (#25751) · Issues · GitLab.org / GitLab · GitLab
Exploit;Vendor Advisory

Jump to