CVE-2020-13344

Published: Oct 8, 2020Modified: Nov 21, 2024

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 0.8 / Impact: 3.6

Source: NVD

Description

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 10.8.0 to 13.2.10
Gitlab Gitlab	From 13.3.0 to 13.3.7
Gitlab Gitlab	From 13.4.0 to 13.4.2
Gitlab Gitlab	From 10.8.0 to 13.2.10
Gitlab Gitlab	From 13.3.0 to 13.3.7
Gitlab Gitlab	From 13.4.0 to 13.4.2