CVE-2020-13270 : What You Need to Know

A vulnerability in GitLab versions 11.3 through 13.0.1 allows guest users to create fork relations on restricted public projects via API.

Understanding CVE-2020-13270

This CVE involves a missing permission check in GitLab, potentially leading to unauthorized actions by guest users.

What is CVE-2020-13270?

The vulnerability allows guest users to create fork relations on restricted public projects through the GitLab API.

The Impact of CVE-2020-13270

CVSS Base Score: 7.5 (High)
Attack Vector: Network
Confidentiality, Integrity, and Availability Impact: High
Privileges Required: Low
Scope: Unchanged
User Interaction: None

Technical Details of CVE-2020-13270

This section provides more in-depth technical information about the vulnerability.

Vulnerability Description

The issue arises from a missing permission check during fork relation creation in GitLab versions 11.3 to 13.0.1, allowing unauthorized actions by guest users.

Affected Systems and Versions

Affected Product: GitLab
Vendor: GitLab
Vulnerable Versions:
=11.3, <12.9.8

=12.10, <12.10.7

=13.0, <13.0.1

Exploitation Mechanism

Guest users can exploit this vulnerability through the GitLab API to create fork relations on restricted public projects.

Mitigation and Prevention

Protect your systems and data from this vulnerability by following these steps:

Immediate Steps to Take

Update GitLab to a patched version that addresses the permission check issue.
Monitor and restrict guest user access to sensitive projects.

Long-Term Security Practices

Regularly review and update access control policies in GitLab.
Conduct security training for users to prevent unauthorized actions.

Patching and Updates

Apply security patches provided by GitLab promptly to mitigate the vulnerability.