CVE-2020-13298 Information

Description

A vulnerability was discovered in GitLab versions before 13.1.10 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters which resulted in the limited files disclosure.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Reference

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13298.json https://gitlab.com/gitlab-org/gitlab/-/issues/228841 https://hackerone.com/reports/923027

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

NONE

Base Score

NONE

Base Severity

5.8