CVE-2020-13350: 
GitLab vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the runner administration page of GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability affects versions >=13.5.0, <13.5.2, >=13.4.0, <13.4.5, and <13.3.9. This security issue was reported through GitLab's HackerOne bug bounty program by researcher @ngalog (GitLab Security Release).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and received a CVSS v3.1 base score of 4.3 (MEDIUM) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. GitLab's own assessment rated it slightly lower at 3.1 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L (NVD Database).

The vulnerability allows an attacker who can target GitLab instance administrators to pause or resume runners through the administration interface. This could potentially impact the availability of CI/CD pipelines by allowing unauthorized control over runner states (GitLab Security Release).

The vulnerability requires the ability to target GitLab instance administrators and trick them into performing specific actions. The attack vector is network-accessible and requires user interaction to exploit (NVD Database).

GitLab has addressed this vulnerability in versions 13.5.2, 13.4.5, and 13.3.9. It is strongly recommended that all affected installations be upgraded to one of these patched versions immediately (GitLab Security Release).