CVE-2020-13306 — Allocation of Resources Without Limits or Throttling in Gitlab

CWE-770 — Allocation of Resources Without Limits or Throttling6 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 63.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedSep 14
Latest updateMay 24

Description

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDgitlab/gitlab13.2.0 — 13.2.8+2
▶debiandebian/gitlab< gitlab 13.2.8-1 (sid)
▶CVEListV5gitlab/gitlab>=1.0, <13.1.10, >=13.2, <13.2.8, >=13.3, <13.3.4+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-jcrh-hfqv-cr47: A vulnerability was discovered in GitLab versions before 13↗2022-05-24
▶
OSV
CVE-2020-13306: A vulnerability was discovered in GitLab versions before 13↗2020-09-14
▶

📋Vendor Advisories

2
GitLab
CVE-2020-13306: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of servi↗2020-09-14
▶
Debian
CVE-2020-13306: gitlab - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13....↗2020
▶

💬Community

1
Bugzilla
CVE-2019-13306 ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors↗2019-07-16
▶