CVE-2020-13330: 
GitLab vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in GitLab's Bitbucket project import feature, affecting versions 11.2 and later. The vulnerability, identified as CVE-2020-13330, was discovered by @saltyyolk of Chaitin Tech and was patched in GitLab versions 13.1.2, 13.0.8, and 12.10.13 released on July 1, 2020 (GitLab Release).

The vulnerability existed in the BitbucketServerImport::Importer component of GitLab, which failed to properly sanitize links of repositories from Bitbucket servers. The issue allowed attackers to set up a malicious Bitbucket server and trick victims into importing repositories from it, potentially executing XSS payloads when victims checked the links of candidate repositories (GitLab Issue).

When successfully exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of the victim's browser session. The attack required user interaction, specifically when the victim checks the links of candidate repositories during the Bitbucket import process (GitLab Issue).

The vulnerability required an attacker to set up a malicious Bitbucket server and convince a user to attempt importing repositories from it. While user interaction was required to complete the attack, attackers could use obfuscation tricks to hide the malicious nature of the payload (GitLab Issue).

GitLab addressed this vulnerability in versions 13.1.2, 13.0.8, and 12.10.13. Users running affected versions are strongly recommended to upgrade to these patched versions or later to mitigate the risk (GitLab Release).