Authorization

2020-06-1922:15:00

PRIOn knowledge base

www.prio-n.com

8.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.3%

JSON

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow

CPENameOperatorVersion
gitlabge12.10.0
gitlablt12.10.7
gitlabge12.10.0
gitlablt12.10.7
gitlabeq13.0.0
gitlabeq13.0.0
gitlabge12.3.0
gitlablt12.9.8
gitlabge12.3.0
gitlablt12.9.8

Name	Operator	Version
gitlab	ge	12.10.0
gitlab	lt	12.10.7
gitlab	ge	12.10.0
gitlab	lt	12.10.7
gitlab	eq	13.0.0
gitlab	eq	13.0.0
gitlab	ge	12.3.0
gitlab	lt	12.9.8
gitlab	ge	12.3.0
gitlab	lt	12.9.8

References

gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13272.json

gitlab.com/gitlab-org/gitlab/-/issues/37038

hackerone.com/reports/743556