FKIE_CVE-2020-13333

Vulnerability from fkie_nvd - Published: 2020-10-06 19:15 - Updated: 2024-11-21 05:01
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Summary
A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.
References
cve@gitlab.comhttps://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13333.jsonThird Party Advisory
cve@gitlab.comhttps://gitlab.com/gitlab-org/gitlab/-/issues/218753Broken Link
cve@gitlab.comhttps://hackerone.com/reports/870820Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13333.jsonThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://gitlab.com/gitlab-org/gitlab/-/issues/218753Broken Link
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/870820Exploit, Third Party Advisory
Impacted products
Vendor Product Version
gitlab gitlab 13.1.0
gitlab gitlab 13.1.0
gitlab gitlab 13.2.0
gitlab gitlab 13.2.0
gitlab gitlab 13.3.0
gitlab gitlab 13.3.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:13.1.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "2FBE37DE-E9C5-40DC-8339-200551D68184",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:13.1.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "89B666E9-BE49-44A5-8FE0-1DF2A370A983",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:13.2.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "82900A58-AAF4-4D9C-A91A-3C86DE7A46F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:13.2.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "F7C9C545-5519-492A-81D7-AC1EC365167A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:13.3.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "3A4E3640-AED5-4318-85B9-91F41264FB09",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:13.3.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "1CF330C9-F018-4F2C-B673-8A38B9434C99",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 una potencial vulnerabilidad de DOS en GitLab versiones 13.1, 13.2 y 13.3.\u0026#xa0;La API para actualizar un activo como un enlace desde una versi\u00f3n que ten\u00eda una comprobaci\u00f3n de expresiones regulares que caus\u00f3 un n\u00famero exponencial de retrocesos para determinados valores suministrados por el usuario, resultando en un alto uso de la CPU"
    }
  ],
  "id": "CVE-2020-13333",
  "lastModified": "2024-11-21T05:01:03.267",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "cve@gitlab.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-10-06T19:15:13.257",
  "references": [
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13333.json"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Broken Link"
      ],
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/218753"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/870820"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13333.json"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/218753"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/870820"
    }
  ],
  "sourceIdentifier": "cve@gitlab.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.