CVE-2013-4580

Published: May 12, 2014Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls.

Affected (128)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

39 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	Up to 5.4.1
Gitlab Gitlab	Version 0.8.0
Gitlab Gitlab	Version 0.9.1
Gitlab Gitlab	Version 0.9.4
Gitlab Gitlab	Version 0.9.6
Gitlab Gitlab	Version 1.0.0
Gitlab Gitlab	Version 1.0.1
Gitlab Gitlab	Version 1.0.2
Gitlab Gitlab	Version 1.1.0
Gitlab Gitlab	Version 1.2.0
Gitlab Gitlab	Version 1.2.1
Gitlab Gitlab	Version 1.2.2
Gitlab Gitlab	Version 2.0.0
Gitlab Gitlab	Version 2.1.0
Gitlab Gitlab	Version 2.2.0
Gitlab Gitlab	Version 2.3.0
Gitlab Gitlab	Version 2.3.1
Gitlab Gitlab	Version 2.4.0
Gitlab Gitlab	Version 2.5.0
Gitlab Gitlab	Version 2.6.0
Gitlab Gitlab	Version 2.7.0
Gitlab Gitlab	Version 2.8.0
Gitlab Gitlab	Version 2.8.1
Gitlab Gitlab	Version 2.9.0
Gitlab Gitlab	Version 2.9.1
Gitlab Gitlab	Version 3.0.0
Gitlab Gitlab	Version 3.0.1
Gitlab Gitlab	Version 3.0.2
Gitlab Gitlab	Version 3.0.3
Gitlab Gitlab	Version 3.1.0
Gitlab Gitlab	Version 4.0.0
Gitlab Gitlab	Version 4.1.0
Gitlab Gitlab	Version 4.2.0
Gitlab Gitlab	Version 5.0.0
Gitlab Gitlab	Version 5.0.1
Gitlab Gitlab	Version 5.1.0
Gitlab Gitlab	Version 5.2.0
Gitlab Gitlab	Version 5.3.0
Gitlab Gitlab	Version 5.4.0

Configuration B

46 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	Up to 6.2.3
Gitlab Gitlab	Version 0.8.0
Gitlab Gitlab	Version 0.9.1
Gitlab Gitlab	Version 0.9.4
Gitlab Gitlab	Version 0.9.6
Gitlab Gitlab	Version 1.0.0
Gitlab Gitlab	Version 1.0.1
Gitlab Gitlab	Version 1.0.2
Gitlab Gitlab	Version 1.1.0
Gitlab Gitlab	Version 1.2.0
Gitlab Gitlab	Version 1.2.1
Gitlab Gitlab	Version 1.2.2
Gitlab Gitlab	Version 2.0.0
Gitlab Gitlab	Version 2.1.0
Gitlab Gitlab	Version 2.2.0
Gitlab Gitlab	Version 2.3.0
Gitlab Gitlab	Version 2.3.1
Gitlab Gitlab	Version 2.4.0
Gitlab Gitlab	Version 2.5.0
Gitlab Gitlab	Version 2.6.0
Gitlab Gitlab	Version 2.7.0
Gitlab Gitlab	Version 2.8.0
Gitlab Gitlab	Version 2.8.1
Gitlab Gitlab	Version 2.9.0
Gitlab Gitlab	Version 2.9.1
Gitlab Gitlab	Version 3.0.0
Gitlab Gitlab	Version 3.0.1
Gitlab Gitlab	Version 3.0.2
Gitlab Gitlab	Version 3.0.3
Gitlab Gitlab	Version 3.1.0
Gitlab Gitlab	Version 4.0.0
Gitlab Gitlab	Version 4.1.0
Gitlab Gitlab	Version 4.2.0
Gitlab Gitlab	Version 5.0.0
Gitlab Gitlab	Version 5.0.1
Gitlab Gitlab	Version 5.1.0
Gitlab Gitlab	Version 5.2.0
Gitlab Gitlab	Version 5.3.0
Gitlab Gitlab	Version 5.4.0
Gitlab Gitlab	Version 5.4.1
Gitlab Gitlab	Version 5.4.2
Gitlab Gitlab	Version 6.0.0
Gitlab Gitlab	Version 6.1.0
Gitlab Gitlab	Version 6.2.0
Gitlab Gitlab	Version 6.2.1
Gitlab Gitlab	Version 6.2.2

Configuration C

43 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	Up to 6.2.0
Gitlab Gitlab	Version 0.8.0
Gitlab Gitlab	Version 0.9.1
Gitlab Gitlab	Version 0.9.4
Gitlab Gitlab	Version 0.9.6
Gitlab Gitlab	Version 1.0.0
Gitlab Gitlab	Version 1.0.1
Gitlab Gitlab	Version 1.0.2
Gitlab Gitlab	Version 1.1.0
Gitlab Gitlab	Version 1.2.0
Gitlab Gitlab	Version 1.2.1
Gitlab Gitlab	Version 1.2.2
Gitlab Gitlab	Version 2.0.0
Gitlab Gitlab	Version 2.1.0
Gitlab Gitlab	Version 2.2.0
Gitlab Gitlab	Version 2.3.0
Gitlab Gitlab	Version 2.3.1
Gitlab Gitlab	Version 2.4.0
Gitlab Gitlab	Version 2.5.0
Gitlab Gitlab	Version 2.6.0
Gitlab Gitlab	Version 2.7.0
Gitlab Gitlab	Version 2.8.0
Gitlab Gitlab	Version 2.8.1
Gitlab Gitlab	Version 2.9.0
Gitlab Gitlab	Version 2.9.1
Gitlab Gitlab	Version 3.0.0
Gitlab Gitlab	Version 3.0.1
Gitlab Gitlab	Version 3.0.2
Gitlab Gitlab	Version 3.0.3
Gitlab Gitlab	Version 3.1.0
Gitlab Gitlab	Version 4.0.0
Gitlab Gitlab	Version 4.1.0
Gitlab Gitlab	Version 4.2.0
Gitlab Gitlab	Version 5.0.0
Gitlab Gitlab	Version 5.0.1
Gitlab Gitlab	Version 5.1.0
Gitlab Gitlab	Version 5.2.0
Gitlab Gitlab	Version 5.3.0
Gitlab Gitlab	Version 5.4.0
Gitlab Gitlab	Version 5.4.1
Gitlab Gitlab	Version 5.4.2
Gitlab Gitlab	Version 6.0.0
Gitlab Gitlab	Version 6.1.0

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

http://www.openwall.com/lists/oss-security/2013/11/15/4

Source: secalert@redhat.com

https://www.gitlab.com/2013/11/14/multiple-critical-vulnerabilities-in-gitlab/

Source: secalert@redhat.com

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2013/11/15/4

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.gitlab.com/2013/11/14/multiple-critical-vulnerabilities-in-gitlab/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.