Base Score

MEDIUM4.3

CVE-2020-13335

Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their group.

VectorNETWORK

Published Bycve@gitlab.com

Published DateOct 07, 2020, 14:15

Weakness Type (CWE):CWE-863

CVSS Metrics

Base Score

4.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

LOW

Availability (A)

NONE

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13335.json
https://gitlab.com/gitlab-org/gitlab/-/issues/27231
https://hackerone.com/reports/503823

Base Score

MEDIUM4.3

Weakness Type (CWE):CWE-863

CVSS Metrics

Base Score

4.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

LOW

Availability (A)

NONE