CVE-2020-13353

LowCVSS 3.2/10Last modified Jun 17, 2026

Description

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.

Metrics

CVSS 3.1 3.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-613

Affected software

VendorProductVersions
GitLabGitaly>=1.79.0, <13.3.9; >=13.4, <13.4.5; >=13.5, <13.5.2

References

Timeline

Published
Nov 17, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-133544.3A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponCVE-2020-133558.1An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows CVE-2020-133568.2An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart CVE-2020-133574.3An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized userCVE-2020-133585.5A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. CVE-2020-133597.6The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainCVE-2020-13367.8An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exCVE-2020-133613.9In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS userCVE-2020-133623.2In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a gCVE-2020-133648.8A backdoor in certain Zyxel products allows remote TELNET access via a CGI script. This affects NAS520 V5.21(AASZ.4)C0, V5.21(AASZ.0)C0, V5.CVE-2020-133658.8Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account CVE-2020-13377.8An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system
CVE-2020-13353: Low severity, CVSS 3.2 | Vulnix