PT-2020-13488 · Gitlab · Gitlab Runner+1

Published 2020-10-07 · Updated 2024-03-06 · CVE-2020-13347

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gitlab runner versions prior to 13.2.4 Gitlab runner versions prior to 13.3.2 Gitlab runner versions prior to 13.4.1

Description A command injection issue was discovered. When the runner is configured on a Windows system with a docker executor, it allows an attacker to run arbitrary commands on the Windows host via the DOCKER AUTH CONFIG build variable.

Recommendations For versions prior to 13.2.4, update to version 13.2.4 or later. For versions prior to 13.3.2, update to version 13.3.2 or later. For versions prior to 13.4.1, update to version 13.4.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-GITLAB-2020-13347

CVE-2020-13347

Affected Products

Gitlab

Gitlab Runner

References · 9

• https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13347.json · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13347 · Security Note
• https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26725 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2020-13347 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13347 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13347 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13347 · Vendor Advisory
• https://hackerone.com/reports/955016 · Note