by Kastro
Paper/Archive/CVE-2020-13347

CVE-2020-13347

GitLab GitLab Runner — A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1.

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 83.2.832 × 2016.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable.

Affected

ProductAffectedFixed inSource
GitLab Runner>=12.0.0, <13.2.4–CNA
GitLab Runner>=13.3.0, <13.3.2–CNA
GitLab Runner>=13.4.0, <13.4.1–CNA

Scores by source

GitLab (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refgitlab.com/gitlab-org/gitlab-runner/-/issues/26725refhackerone.com/reports/955016refgitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13347.json