CVE-2020-13319: 
GitLab vulnerability analysis and mitigation

A permission check vulnerability (CVE-2020-13319) was discovered in GitLab affecting versions prior to 13.1.2, 13.0.8, and 12.10.13. The vulnerability allowed non-project members to manipulate time tracking features on issues they created, which contradicted GitLab's documented security controls (GitLab Release, CVE Mitre).

The vulnerability stemmed from a missing permission check in GitLab's time tracking API endpoints. Non-member users could exploit this vulnerability through the API to add spent time and reset spent time on issues they created in public projects, even though such actions were supposed to be restricted to project members only. This could be accomplished using specific API endpoints: '/add_spent_time' and '/reset_spent_time' (HackerOne Report).

The vulnerability allowed unauthorized users to manipulate time tracking data on issues they created, bypassing intended access controls. This could lead to inaccurate project time tracking and potentially affect project management metrics (GitLab Release).

The vulnerability could be exploited by making HTTP POST requests to specific API endpoints with a valid private token. The exploitation required the attacker to have created an issue in a public project, but no project membership was necessary (HackerOne Report).

GitLab addressed this vulnerability in versions 13.1.2, 13.0.8, and 12.10.13. Users were strongly recommended to upgrade to these or later versions immediately. The fix implemented proper permission checks for time tracking operations through the API (GitLab Release).