CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0, <13.4.5,<13.3.9.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target     GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0,     <13.4.5,<13.3.9. (CVE-2020-13350)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target     GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0,     <13.4.5,<13.3.9. (CVE-2020-13350)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Gitlab reports :

Path Traversal in LFS Upload

Path traversal allows saving packages in arbitrary location

Kubernetes agent API leaks private repos

Terraform state deletion API exposes object storage URL

Stored-XSS in error message of build-dependencies

Git credentials persisted on disk

Potential Denial of service via container registry

Info leak when group is transferred from private to public group

Limited File Disclosure Via Multipart Bypass

Unauthorized user is able to access scheduled pipeline variables and values

CSRF in runner administration page allows an attacker to pause/resume runners

Regex backtracking attack in path parsing of Advanced Search result

Bypass of required CODEOWNERS approval

SAST CiConfiguration information visible without permissions

ID	Name	Product	Family	Severity
251217	Linux Distros Unpatched Vulnerability : CVE-2020-13350	Nessus	Misc.	medium
197324	GitLab < 13.3.9 (CVE-2020-13350)	Nessus	CGI abuses	medium
142275	FreeBSD : Gitlab -- Multiple vulnerabilities (174e466b-1d48-11eb-bd0f-001b217b3468)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2020-13350

medium

Tenable Plugins

medium

medium

high