CVE-2020-13348 : Security Advisory and Response

An issue has been discovered in GitLab EE that affects versions starting from 10.2, allowing bypass of required CODEOWNERS approval. This vulnerability has a CVSS base score of 5.7.

Understanding CVE-2020-13348

This CVE involves an improper authorization issue in GitLab EE.

What is CVE-2020-13348?

This vulnerability in GitLab EE allows bypassing required CODEOWNERS approval by targeting a branch without the CODEOWNERS file.

The Impact of CVE-2020-13348

The vulnerability has a CVSS base score of 5.7, with medium severity. It affects versions >=10.2, <13.3.9, >=13.4, <13.4.5, and >=13.5, <13.5.2. The integrity impact is high, and user interaction is required for exploitation.

Technical Details of CVE-2020-13348

This section provides more technical insights into the CVE.

Vulnerability Description

The vulnerability allows bypassing required CODEOWNERS approval in GitLab EE by targeting a branch without the CODEOWNERS file.

Affected Systems and Versions

Product: GitLab EE
Vendor: GitLab
Affected Versions: >=10.2, <13.3.9, >=13.4, <13.4.5, >=13.5, <13.5.2

Exploitation Mechanism

Attack Complexity: Low
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Integrity Impact: High
Scope: Unchanged
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Mitigation and Prevention

Protect your systems from CVE-2020-13348 with the following steps.

Immediate Steps to Take

Update GitLab EE to a non-vulnerable version.
Implement strict branch access controls.
Monitor branch changes for unauthorized modifications.

Long-Term Security Practices

Regularly review and update access control policies.
Conduct security training for developers on code review best practices.

Patching and Updates

Apply security patches provided by GitLab promptly.