Medium severity6.1NVD Advisory· Published Jun 10, 2020· Updated Jun 17, 2026
CVE-2020-13267
CVE-2020-13267
Description
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1
Affected products
6cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=12.8.0,<=13.0.1
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=12.8.0,<=13.0.1
- (no CPE)range: >=12.8 <=13.0.1
- (no CPE)range: >=12.8, <12.9.8
- Range: >=12.8 <=13.0.1
Patches
Vulnerability mechanics
References
3- gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13267.jsonnvdVendor Advisory
- gitlab.com/gitlab-org/gitlab/-/issues/211956nvdVendor Advisory
- hackerone.com/reports/824773nvdPermissions RequiredThird Party Advisory
News mentions
0No linked articles in our index yet.