CVE-2020-13284: 
GitLab vulnerability analysis and mitigation

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4 related to API Authorization Using Outdated CI Job Token. The vulnerability was assigned CVE-2020-13284 and was disclosed on September 2, 2020. This issue affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 11.3 and later (GitLab Release).

The vulnerability has a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. The issue stems from GitLab not validating that job tokens were associated with running jobs, which could lead to unauthorized access to resources. The vulnerability is classified under CWE-863 (Incorrect Authorization) (NVD).

The vulnerability could allow an attacker to access unauthorized resources using outdated job tokens, potentially leading to unauthorized access to sensitive information and system modifications (GitLab Release).

The vulnerability requires network access and high privileges for exploitation, but has low attack complexity and requires no user interaction as indicated by the CVSS vector string (NVD).

GitLab strongly recommends that all installations running an affected version be upgraded to version 13.1.10, 13.2.8, or 13.3.4 immediately. These versions contain the security fix for this vulnerability (GitLab Release).