Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2020-13336
CVE-2020-13336:
GitLab vulnerability analysis and mitigation
Overview
A stored Cross-Site Scripting (XSS) vulnerability was discovered in GitLab's error tracking feature, affecting versions from 11.8 before 12.10.13. The vulnerability was assigned identifier CVE-2020-13336 and was disclosed on July 1, 2020 (GitLab Release, CVE Mitre).
Technical details
The vulnerability allowed attackers to inject stored cross-site scripting payloads in the Error Tracking page of GitLab. The issue was discovered and reported by security researcher mike12 through the HackerOne platform (GitLab Release).
Impact
The vulnerability could allow attackers to perform any action within the application that a user can perform, steal sensitive user data, and potentially compromise user credentials (GitLab Issue).
Exploitability
The vulnerability required an attacker to set up a malicious Sentry server and exploit the Error Tracking feature integration with GitLab (GitLab Issue).
Mitigation and workarounds
The vulnerability was patched in GitLab versions 13.1.2, 13.0.8, and 12.10.13. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately (GitLab Release).
Additional resources
Source: This report was generated using AI
Related GitLab vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management