CVE-2020-13359

published 2020-11-19

CVE-2020-13359: The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the…

Priority P3 39 high 7.6 CVSS 3.1

AV N AC L PR H UI N S C C L I H A N

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, =13.4, =13.5, <13.5.2.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 13.3.9-1 (sid)	gitlab 13.3.9-1 (sid)
gitlab	gitlab	—	—
gitlab	gitlab	>= 12.10.0 < 13.3.9	13.3.9
gitlab	gitlab	>= 13.4.0 < 13.4.5	13.4.5
gitlab	gitlab	>= 13.5.0 < 13.5.2	13.5.2
gitlab	gitlab_ce	—	—
gitlab	gitlab_ce_ee	—	—
gitlab	gitlab_ce_ee	—	—
gitlab	gitlab_ce_ee	—	—
gitlab	gitlab_ce_ee	—	—
gitlab	gitlab_ce_ee	—	—
gitlab	gitlab_ce_ee	—	—

CVSS provenance

nvd v3.1 7.6 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:N

vendor_debian 7.6 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200