PT-2020-13447 · Gitlab · Gitlab

Noddyn12 · Published 2020-09-14 · Updated 2024-03-06 · CVE-2020-13306

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4

Description A denial of service attack can be performed due to the lack of rate limitation in the GitLab Webhook feature.

Recommendations For versions prior to 13.1.10, update to version 13.1.10 or later. For versions prior to 13.2.8, update to version 13.2.8 or later. For versions prior to 13.3.4, update to version 13.3.4 or later.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-GITLAB-2020-13306

CVE-2020-13306

Affected Products

Gitlab

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2020-13306 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-13306 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13306 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13306 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13306 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2020-13306 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/223681 · Note
• https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released · Note
• https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13306.json · Note
• https://hackerone.com/reports/904134 · Note