CVE-2020-13277: 
GitLab vulnerability analysis and mitigation

An authorization issue was discovered in GitLab CE/EE versions 10.6 through 13.0.5 affecting the mirroring logic functionality. The vulnerability, identified as CVE-2020-13277, was disclosed on June 10, 2020, and allowed unauthorized read access to private repositories (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) by NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. GitLab Inc. assessed it slightly differently with a CVSS score of 6.3 (Medium) and vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N. The vulnerability is classified under CWE-863 (Incorrect Authorization) (NVD).

The vulnerability allowed attackers to gain unauthorized read access to private repositories through the mirroring logic functionality. This could potentially expose sensitive information stored in private repositories to unauthorized users (GitLab Release).

The vulnerability could be exploited by an attacker to access private repositories through the mirroring logic. The attack required network access and low privileges to execute (NVD).

GitLab addressed this vulnerability in versions 13.0.6, 12.10.11, and 12.9.10 for both Community Edition (CE) and Enterprise Edition (EE). Users are strongly recommended to upgrade to one of these patched versions immediately (GitLab Release).

The vulnerability was responsibly reported by security researcher @u3mur4 through GitLab's bug bounty program. GitLab responded by releasing a critical security update to address the issue (GitLab Release).