CVE-2020-13299: 
GitLab vulnerability analysis and mitigation

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4 where the session revocation feature was not properly functioning. The vulnerability, identified as CVE-2020-13299, was discovered by security researcher vaib25vicky and disclosed in September 2020. The issue affected all previous GitLab versions (GitLab Security Release).

The vulnerability stemmed from an implementation flaw in GitLab's session management system where the remember_user_token was not being properly invalidated during session revocation. When a user attempted to revoke active sessions, only the session token was invalidated while the remember_user_token remained valid. This allowed the creation of new valid session tokens using the preserved remember_user_token, effectively bypassing the session revocation mechanism (GitLab Issue).

The vulnerability could allow an attacker with access to a user's remember_user_token to maintain persistent access to the victim's account, even after the legitimate user had attempted to revoke all active sessions. This could lead to unauthorized access to sensitive information and account settings, effectively enabling account takeover (GitLab Security Release).

The vulnerability could be exploited by an attacker who had previously obtained access to a user's remember_user_token. Even after the victim attempted to revoke active sessions, the attacker could use the token to create new valid sessions and maintain access to the account (GitLab Issue).

The vulnerability was patched in GitLab versions 13.1.10, 13.2.8, and 13.3.4. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately to address this security issue (GitLab Security Release).