Medium severity6.1NVD Advisory· Published Jun 10, 2020· Updated Jun 17, 2026
CVE-2020-13271
CVE-2020-13271
Description
A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1
Affected products
6cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: <12.9.8
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: <12.9.8
- (no CPE)range: <=13.0.1
- (no CPE)range: <12.9.8
- Range: <=13.0.1
Patches
Vulnerability mechanics
References
3- gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13271.jsonnvdVendor Advisory
- gitlab.com/gitlab-org/gitlab/-/issues/200094nvdBroken LinkVendor Advisory
- hackerone.com/reports/672150nvdPermissions RequiredThird Party Advisory
News mentions
0No linked articles in our index yet.