Описание
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session.
Ссылки
- Vendor Advisory
- Broken Link
- Permissions RequiredThird Party Advisory
- Vendor Advisory
- Broken Link
- Permissions RequiredThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 13.1.0 (включая) до 13.1.10 (исключая)Версия от 13.1.0 (включая) до 13.1.10 (исключая)Версия от 13.2.0 (включая) до 13.2.8 (исключая)Версия от 13.2.0 (включая) до 13.2.8 (исключая)Версия от 13.3.0 (включая) до 13.3.4 (исключая)Версия от 13.3.0 (включая) до 13.3.4 (исключая)
Одно из
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
EPSS
Процентиль: 40%
0.00186
Низкий
8.1 High
CVSS3
5.5 Medium
CVSS2
Дефекты
CWE-613
Связанные уязвимости
CVSS3: 8.1
ubuntu
больше 5 лет назад
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session.
CVSS3: 8.1
debian
больше 5 лет назад
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2 ...
CVSS3: 8.1
github
больше 3 лет назад
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session.
EPSS
Процентиль: 40%
0.00186
Низкий
8.1 High
CVSS3
5.5 Medium
CVSS2
Дефекты
CWE-613