Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2020-13342
CVE-2020-13342:
GitLab vulnerability analysis and mitigation
Overview
An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7, and 13.4.2 related to a lack of rate limiting when resending confirmation emails (NVD, CVE).
Technical details
The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS v3.1 base score is 2.7 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L, while the CVSS v2.0 base score is 4.0 (MEDIUM) with the vector (AV:N/AC:L/Au:S/C:N/I:N/A:P) (NVD).
Impact
The vulnerability could allow an attacker to perform a Denial-of-Service (DoS) attack against the web server by repeatedly triggering confirmation email requests without any restrictions (GitLab Issue).
Exploitability
The vulnerability can be exploited by accessing the profile/emails page, adding a random email address, and repeatedly clicking the resend confirmation email button without any rate limiting restrictions (GitLab Issue).
Mitigation and workarounds
The issue has been fixed in GitLab versions 13.2.10, 13.3.7, and 13.4.2. Users should upgrade to these versions or newer to mitigate the vulnerability (NVD).
Additional resources
Source: This report was generated using AI
Related GitLab vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management