CVE-2020-13344

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2

Medium · published October 8, 2020

CVSS v3.1
5.7
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00357 · 28.3th percentile
Published
2020-10-08T13:43Z
EPSS history
Timeline
  • 08 OCT 13:43Z
    An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2
    cvelistv5