Design/Logic Flaw

2020-08-1014:15:00

PRIOn knowledge base

www.prio-n.com

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.7%

In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.

CPENameOperatorVersion
gitlabge13.2.0
gitlablt13.2.3
gitlabge13.1.0
gitlablt13.1.6
gitlabge7.7.0
gitlablt13.0.12

Name	Operator	Version
gitlab	ge	13.2.0
gitlab	lt	13.2.3
gitlab	ge	13.1.0
gitlab	lt	13.1.6
gitlab	ge	7.7.0
gitlab	lt	13.0.12

References

gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13294.json

gitlab.com/gitlab-org/gitlab/-/issues/26147

hackerone.com/reports/469728