Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2020-13316: GitLab allows access to disabled repositories via deploy token
CVE-2020-13316 · published 6 years ago
Summary
Versions of GitLab before 13.1.10, 13.2.8, and 13.3.4 do not properly check a deploy token, so a repository that has been disabled can still be reached with a git command. This could let unauthorized users view or clone code that should be inaccessible. Upgrade GitLab to the latest release that includes the fix.
What to do
- Update gitlab to version 13.3.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | gitlab |
>= 13.3.0, < 13.3.4 Fix: upgrade to 13.3.4
|
| – | gitlab | gitlab |
>= 13.1.0, < 13.1.10 >= 13.2.0, < 13.2.8 >= 13.3.0, < 13.3.4 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line.
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line.
References
- https://hackerone.com/reports/884174 Permissions Required Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-13316 URL
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13316.json Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/220137 Broken Link
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published14 Sep 2020
Updated31 Oct 2026
First seen23 Aug 2026
Track software like this
Free during beta