Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-13347

A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable.

Published

2020-10-07T14:15:11.827

Last Modified

2024-11-21T05:01:05.207

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application gitlab gitlab < 13.2.4 Yes
Application gitlab gitlab < 13.2.4 Yes
Application gitlab gitlab < 13.3.2 Yes
Application gitlab gitlab < 13.3.2 Yes
Application gitlab gitlab < 13.4.1 Yes
Application gitlab gitlab < 13.4.1 Yes
References