An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored     XSS in CI Job Log (CVE-2020-13340)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored     XSS in CI Job Log (CVE-2020-13340)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Gitlab reports :

Path Traversal in LFS Upload

Path traversal allows saving packages in arbitrary location

Kubernetes agent API leaks private repos

Terraform state deletion API exposes object storage URL

Stored-XSS in error message of build-dependencies

Git credentials persisted on disk

Potential Denial of service via container registry

Info leak when group is transferred from private to public group

Limited File Disclosure Via Multipart Bypass

Unauthorized user is able to access scheduled pipeline variables and values

CSRF in runner administration page allows an attacker to pause/resume runners

Regex backtracking attack in path parsing of Advanced Search result

Bypass of required CODEOWNERS approval

SAST CiConfiguration information visible without permissions

ID	Name	Product	Family	Type	Severity
258467	Linux Distros Unpatched Vulnerability : CVE-2020-13340	Nessus	Misc.	Local	high
197402	GitLab 12.4 < 13.2.10 / 13.3 < 13.3.7 / 13.4 < 13.4.2 (CVE-2020-13340)	Nessus	CGI abuses	Combined	high
142275	FreeBSD : Gitlab -- Multiple vulnerabilities (174e466b-1d48-11eb-bd0f-001b217b3468)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2020-13340

high

Tenable Plugins

high

high

high