CVE-2020-13282 - For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access

Back Back to CVE browser

LOW

For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access

Published Aug 13, 2020

3.5

LOW

CVSS 3.1

EPSS 0.68%

Description

For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access.

Affected products

Vendor GitLab Product GitLab Default
unknown
Affected
- ≥ 10.5, < 13.0.12
- ≥ 13.1, < 13.1.6
- ≥ 13.2, < 13.2.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
GitLab	GitLab	unknown	Affected ≥ 10.5, < 13.0.12 ≥ 13.1, < 13.1.6 ≥ 13.2, < 13.2.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-281

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5542
Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13282.json
x_refsource_CONFIRMThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/202687
x_refsource_MISCBroken Link
https://hackerone.com/reports/790786
x_refsource_MISCPermissions RequiredThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5542		Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13282.json		x_refsource_CONFIRMThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/202687		x_refsource_MISCBroken Link
https://hackerone.com/reports/790786		x_refsource_MISCPermissions RequiredThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitLab

Published Aug 13, 2020

Updated Aug 4, 2024

Reserved May 21, 2020

Link CVE-2020-13282

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-13282

Red Hat

No data

ENISA EUVD

Assigner GitLab

Published Aug 13, 2020

Updated Aug 4, 2024

Link EUVD-2020-5542

GitHub

No data