CVE-2020-13355 : What You Need to Know

An issue has been discovered in GitLab CE/EE that affects versions starting from 8.14, allowing a path traversal in LFS Upload, enabling attackers to overwrite specific paths on the server.

Understanding CVE-2020-13355

This CVE identifies a path traversal vulnerability in GitLab CE/EE versions.

What is CVE-2020-13355?

The vulnerability in GitLab CE/EE versions >=8.14 and <13.5.2 allows unauthorized users to manipulate file paths, potentially leading to unauthorized access and data manipulation.

The Impact of CVE-2020-13355

The vulnerability has a CVSS base score of 7.5 (High severity) with significant impacts on confidentiality, integrity, and availability of affected systems.

Technical Details of CVE-2020-13355

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The issue involves improper path limitation in GitLab, enabling path traversal attacks.

Affected Systems and Versions

Affected versions: >=8.14, <13.3.9, >=13.4, <13.4.5, >=13.5, <13.5.2
Product: GitLab CE/EE
Vendor: GitLab

Exploitation Mechanism

Attack Complexity: High
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Mitigation and Prevention

Protect your systems from CVE-2020-13355 with the following steps:

Immediate Steps to Take

Apply security patches provided by GitLab promptly.
Monitor for any unauthorized access or file modifications.

Long-Term Security Practices

Regularly update and patch GitLab installations.
Implement access controls and restrictions to prevent unauthorized access.

Patching and Updates

Stay informed about security updates from GitLab.
Regularly check for new patches and apply them to ensure system security.