CVE-2020-13314
Description
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages.
Summary dbcve.org
This is a reflected XSS (cross-site scripting) vulnerability in GitLab's Omniauth authentication endpoint. A malicious user can submit crafted content that gets reflected back and displayed within error messages rendered to the victim. When the victim views these error messages, arbitrary JavaScript can execute in their browser context, potentially leading to session hijacking, cookie theft, or other client-side attacks.
Mitigation
Upgrade GitLab to version 13.1.10, 13.2.8, 13.3.4 or later. Alternatively, if immediate upgrade is not feasible, consider disabling or restricting Omniauth authentication methods until the patch can be applied.