CVE-2020-15525

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/Vendor Advisory
https://about.gitlab.com/releases/categories/releases/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/225259Broken Link
https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released/Vendor Advisory
https://about.gitlab.com/releases/categories/releases/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/225259Broken Link

Timeline

Published: Jul 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-155265.9In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks can extend beyond that CVE-2020-155287.8An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or uninstalls a game beca CVE-2020-155297.8An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a ve CVE-2020-15537.8An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully e CVE-2020-155307.8An issue was discovered in Valve Steam Client 2.10.91.91. The installer allows local users to gain NT AUTHORITY\SYSTEM privileges because so CVE-2020-155318.8Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air remote code execution vul CVE-2020-155326.5Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air denial of service vulnera CVE-2020-155339.8In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnera CVE-2020-155356.1An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the regis CVE-2020-155366.1An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of th CVE-2020-155376.1An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI CVE-2020-155386.1XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar.