CVE-2020-13318: 
GitLab vulnerability analysis and mitigation

A cross-account assume role attack vulnerability was discovered in GitLab's EKS (Elastic Kubernetes Service) integration affecting versions before 13.0.12, 13.1.10, 13.2.8, and 13.3.4. The vulnerability was assigned CVE-2020-13318 and was disclosed on September 2, 2020. This security issue affected GitLab installations from version 8.9 onwards (GitLab Release).

The vulnerability was present in GitLab's EKS integration system, specifically related to the AWS role assumption mechanism. The issue could potentially allow unauthorized access through a cross-account assume role attack vector (GitLab Release).

If exploited, this vulnerability could lead to privileged access and potentially result in AWS account takeover, significantly compromising the security of the affected GitLab installations and their associated AWS resources (GitLab Release).

The vulnerability affected GitLab installations from version 8.9 onwards until the release of the security patches. While specific exploit details were not publicly disclosed, the vulnerability was considered serious enough to warrant an immediate security release (GitLab Release).

GitLab addressed this vulnerability by releasing security patches in versions 13.0.12, 13.1.10, 13.2.8, and 13.3.4. Users were strongly recommended to upgrade their GitLab installations to one of these patched versions immediately to mitigate the risk (GitLab Release).