{"containers": {"cna": {"affected": [{"product": "GitLab Runner", "vendor": "GitLab", "versions": [{"status": "affected", "version": ">=13.4.0, <13.4.2"}, {"status": "affected", "version": ">=13.3.0, <13.3.7"}, {"status": "affected", "version": ">=13.2.0, <13.2.10"}]}], "credits": [{"lang": "en", "value": "This vulnerability has been discovered internally by the GitLab team"}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 before 13.3.7, all versions starting from 13.2.0 before 13.2.10. Insecure Runner Configuration in Kubernetes Environments"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Configuration in GitLab Runner", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-10-22T20:05:58", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26833"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13327.json"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@gitlab.com", "ID": "CVE-2020-13327", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "GitLab Runner", "version": {"version_data": [{"version_value": ">=13.4.0, <13.4.2"}, {"version_value": ">=13.3.0, <13.3.7"}, {"version_value": ">=13.2.0, <13.2.10"}]}}]}, "vendor_name": "GitLab"}]}}, "credit": [{"lang": "eng", "value": "This vulnerability has been discovered internally by the GitLab team"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 before 13.3.7, all versions starting from 13.2.0 before 13.2.10. Insecure Runner Configuration in Kubernetes Environments"}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Configuration in GitLab Runner"}]}]}, "references": {"reference_data": [{"name": "https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26833", "refsource": "MISC", "url": "https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26833"}, {"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13327.json", "refsource": "CONFIRM", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13327.json"}]}}}}, "cveMetadata": {"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2020-13327", "datePublished": "2020-10-22T20:05:58", "dateReserved": "2020-05-21T00:00:00", "dateUpdated": "2020-10-22T20:05:58", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:runner:*:*:*:*:*:*:*:*", "matchCriteriaId": "8219E6B8-5839-4A71-8B29-78EA9FBC99CB", "versionEndExcluding": "13.2.10", "versionStartIncluding": "13.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:runner:*:*:*:*:*:*:*:*", "matchCriteriaId": "87A15931-6F16-4BA7-B98F-41087B5165EB", "versionEndExcluding": "13.3.7", "versionStartIncluding": "13.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:runner:*:*:*:*:*:*:*:*", "matchCriteriaId": "90E52703-4297-4A7C-8BE5-7C627F3D4F61", "versionEndExcluding": "13.4.2", "versionStartIncluding": "13.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 before 13.3.7, all versions starting from 13.2.0 before 13.2.10. Insecure Runner Configuration in Kubernetes Environments"}, {"lang": "es", "value": "Se ha detectado un problema en GitLab Runner que afecta a todas las versiones desde 13.4.0 versiones anteriores a 13.4.2, todas las versiones desde 13.3.0 versiones anteriores a 13.3.7, todas las versiones desde 13.2.0 versiones anteriores a 13.2.10.&#xa0;Una Configuraci\u00f3n de Ejecuci\u00f3n No Segura en Entornos Kubernetes"}], "id": "CVE-2020-13327", "lastModified": "2020-11-02T14:58:34.497", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.7, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2020-10-22T21:15:12.810", "references": [{"source": "cve@gitlab.com", "tags": ["Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13327.json"}, {"source": "cve@gitlab.com", "tags": ["Broken Link", "Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26833"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}