CVE-2020-13351: 
GitLab vulnerability analysis and mitigation

A vulnerability in GitLab CE/EE versions 13.0 and above was identified where insufficient permission checks in the scheduled pipeline API allowed unauthorized access to sensitive information. The vulnerability, tracked as CVE-2020-13351, affected versions >=13.0, <13.3.9, >=13.4.0, <13.4.5, >=13.5.0, <13.5.2. This security flaw was discovered and reported through GitLab's HackerOne bug bounty program (GitLab Release, CVE Mitre).

The vulnerability stemmed from improper permission checks in the scheduled pipeline API, which allowed attackers to read variable names and values for scheduled pipelines on projects that were visible to them. This security flaw contradicted GitLab's intended security model, which specified that only owners and masters should have full access to read, modify, and delete variables, while developers should only have listing privileges without read access (GitLab Issue).

The vulnerability allowed unauthorized users to access scheduled pipeline variables and values, potentially exposing sensitive configuration data. This security breach enabled attackers to read custom variables and their values from scheduled pipelines, even if they were not members of the project, effectively bypassing the intended access control mechanisms (GitLab Issue).

The vulnerability could be exploited by making an API request to the pipeline schedules endpoint using a private token, even without proper project membership. A proof of concept demonstrated that unauthorized users could access the variables by sending a request to the GitLab API endpoint for pipeline schedules (GitLab Issue).

The vulnerability was addressed in GitLab versions 13.5.2, 13.4.5, and 13.3.9. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately to mitigate this security risk (GitLab Release).