CVE-2020-13307

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...

CVE-2020-13308

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

Authentication flaw

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

CVE-2020-13308

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

CVE-2020-13307

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...

CVE-2020-13307

Removed by vendor...

CVE-2020-13308

GitLab CVE-2020-13308 affects GitLab versions before 13.1.10, 13.2.8, and 13.3.4. A user without two‑factor authentication could be prohibited from accessing GitLab by being invited into a project that uses 2FA inheritance. Remediation is to upgrade to the fixed releases (13.1.10+, 13.2.8+, 13.3....

CVE-2020-13308

Removed by vendor...

CVE-2020-13307: Insufficient Session Expiration

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...

CVE-2020-13308: Improper Preservation of Permissions

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

CVE-2020-13304

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions...

CVE-2020-13304

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions...

CVE-2020-13297

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint...

Design/Logic Flaw

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions...

CVE-2020-13297

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint...

CVE-2020-13297

CVE-2020-13297 : GitLab versions before 13.1.10, 13.2.8, and 13.3.4 are affected. A flaw allows a malicious user to bypass the 2FA restriction for groups by sending a crafted query to the API endpoint. The vulnerability is caused by improper authorization checks in the group-level 2FA flow, enabl...

CVE-2020-13304

The CVE applies to GitLab prior to 13.1.10, 13.2.8, and 13.3.4, where a vulnerability allows a Same 2 Factor Authentication secret code to be generated, enabling an attacker to maintain access under certain conditions. The connected documents corroborate the same description across multiple sourc...

CVE-2020-13304

Removed by vendor...

CVE-2020-13304: Use of Insufficiently Random Values

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions...

Race condition

A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny an access request prior to unlocking the application with a PIN on older Android devices effectively bypassing the PIN requirement...