Skip to content
CVE PROGRAM SOURCE RECORD5.7 Medium

CVE-2020-13344

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitLab

Description

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GitLab GitLab

  • >=10.8, <13.2.10affected
  • >=13.3.0, <13.3.7affected
  • >=13.4.0, <13.4.2affected

References