CVE-2020-13340: An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log

High severity · published Oct 8, 2020

CVE-2020-13340

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log

8.7

CVSS

66.7%

EPSS

On KEV

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

High

Integrity

High

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)66.7% · higher than 99% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

GitLab · GitLab

before 13.2.10; before 13.2.10; 13.3.0 before 13.3.7; 13.3.0 before 13.3.7; 13.4.0 before 13.4.2; 13.4.0 before 13.4.2 · source: NVD

Affected product

GitLab

All GitLab CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-13340

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-13340

Third Party Advisory

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13340.json

Broken Link

https://gitlab.com/gitlab-org/gitlab/-/issues/233473

Permissions Required

https://hackerone.com/reports/950190