CVE-2020-13288: 
GitLab vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was identified in GitLab's CI/CD Jobs page, tracked as CVE-2020-13288. The vulnerability was discovered in GitLab versions 13.0 and later, and was disclosed and patched in GitLab security release versions 13.2.3, 13.1.6, and 13.0.12 released on August 5, 2020. The vulnerability was responsibly reported by security researcher mike12 (GitLab Release).

The vulnerability existed in the CI/CD Jobs page where user-controlled input was not properly sanitized. The issue specifically involved the improper handling of the kubernetes namespace parameter in the environments_block.vue file, which could be exploited through multiple code paths including lines 125, 156, and 251 (GitLab Issue).

The vulnerability could allow an attacker to perform stored XSS attacks, potentially enabling them to perform any action within the application that a user can perform, steal sensitive user data, and compromise user credentials (GitLab Issue).

The vulnerability could be exploited by creating a new project with a specially crafted kubernetes namespace parameter in the CI/CD configuration. The attack vector required the ability to create or modify CI/CD pipeline configurations in a GitLab project (GitLab Issue).

GitLab addressed this vulnerability in versions 13.2.3, 13.1.6, and 13.0.12. Users running affected versions were strongly recommended to upgrade immediately to one of these patched versions to mitigate the security risk (GitLab Release).