VulnerabilityModified
CVE-2020-13344
Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis
MEDIUM 4.4EPSS 0.34%
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis
- CVSS 3.1
- 4.4 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.34% probability · 28th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-522
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13344.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/17817Broken Link
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13344.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/17817Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.