CVE-2020-13298: 
GitLab vulnerability analysis and mitigation

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4, identified as CVE-2020-13298. The vulnerability was related to the Conan package upload functionality, which failed to properly validate supplied parameters, potentially leading to limited file disclosure. The issue was discovered and reported by security researcher ledz1996 and was patched in September 2020 (GitLab Release, NVD).

The vulnerability stemmed from improper validation in the Conan packages API. The issue involved a bypass of Workhorse file validation through the manipulation of file paths. The vulnerability received a CVSS v3.1 score of 5.8 (Medium) and a CVSS v2.0 score of 5.0 (Medium), indicating moderate severity (NVD).

The exploitation of this vulnerability could result in unauthorized file disclosure within the allowed path of the GitLab instance. This could potentially expose sensitive information stored in the system to unauthorized users (GitLab Release).

The vulnerability could be exploited through the Conan package upload functionality by manipulating file parameters. A proof of concept was demonstrated showing how the Workhorse bypass could be achieved to access unauthorized files (HackerOne).

GitLab addressed this vulnerability in versions 13.1.10, 13.2.8, and 13.3.4. Users running affected versions were strongly recommended to upgrade to the latest version immediately to mitigate the risk (GitLab Release).