CVE-2020-13262 - Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link

Back Back to CVE browser

MEDIUM

Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link

Published Jun 19, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 0.87%

Description

Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link

Affected products

Vendor GitLab Product GitLab Default
n/a
- Version
  >=12.10, <12.10.7
  Status
  affected
  Constraints
  -
- Version
  >=12.9, <12.9.8
  Status
  affected
  Constraints
  -
- Version
  >=13.0, <13.0.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

n/a

Version	Status	Constraints
>=12.10, <12.10.7	affected	-
>=12.9, <12.9.8	affected	-
>=13.0, <13.0.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-74

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5523
Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13262.json
x_refsource_CONFIRMVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/211949
x_refsource_MISCBroken Link
https://hackerone.com/reports/824689
x_refsource_MISCPermissions Required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5523		Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13262.json		x_refsource_CONFIRMVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/211949		x_refsource_MISCBroken Link
https://hackerone.com/reports/824689		x_refsource_MISCPermissions Required