BIT-gitlab-2020-13300

BIT-gitlab-2020-13300 PUBLISHED CVSS 10 CRITICAL

GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.

Risk Scores

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Bitnami	gitlab	13.3.0, 13.3.0, 13.3.0

Exploit Intelligence

https://hackerone.com/reports/884766 (osv)

Timeline

Mar 6, 2024 CVE Published
Apr 3, 2025 CVE Updated

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13300.json url
https://gitlab.com/gitlab-org/gitlab/-/issues/219931 url
https://hackerone.com/reports/884766 url
https://nvd.nist.gov/vuln/detail/CVE-2020-13300 url

Open in Interactive Console →