7.6
Élevée
CVE-2020-13359 The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a…
Description
The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| GitLab CE/EE 13.5 | premières → dernières | 13.5.2 |
| GitLab CE/EE 13.4 | premières → dernières | 13.4.5 |
| GitLab CE/EE 13.3 | premières → < 13.3.9 | 13.3.9 |
| GitLab CE/EE 12.10 | 12.10 → dernières | Pas de correctif indiqué |
Autres CVE de GitLab CE/EE
Les 22 CVE de GitLab CE/EE →
CVE-2020-26408
A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to =13.5 to =13.6…
5.3
Moyenne
CVE-2020-13357
An issue was discovered in Gitlab CE/EE versions >= 13.1 to = 13.5 to = 13.6…
4.3
Moyenne
CVE-2020-26413
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2
5.3
Moyenne
CVE-2020-26417
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership
5.3
Moyenne