CVE-2020-13359

HIGH

GitLab 12.10-13.2.9 13.4-13.4.4 13.5-13.5.1 - Authenticated Terraform State Overwrite via Delete Operation

Title source: llm
STIX 2.1

Description

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

References (2)

Core 2
Core References

Scores

CVSS v3 7.6
EPSS 0.0009
EPSS Percentile 24.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

Details

Status published
Products (1)
gitlab/gitlab 12.10.0 - 13.3.9 (2 CPE variants)
Published Nov 19, 2020
Tracked Since Feb 18, 2026