CVE-2020-13341

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer role to perform various deletions.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-843

Affected software

No affected versions have been published.

Timeline

Published: Oct 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-133422.7An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmat CVE-2020-133438.8An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Project Template CVE-2020-133444.4An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in CVE-2020-133455.4An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes CVE-2020-133466.5Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to a CVE-2020-133479.1A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured CVE-2020-133485.7An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targe CVE-2020-133494.3An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in CVE-2020-13357.8<p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An CVE-2020-133504.3CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to CVE-2020-133516.5Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for sche CVE-2020-133525.3Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected