CVE-2020-13359

—

CVSS 3.1

7.6 high

EPSS

<1%p53

Published

Nov 19, 2020 (Nov 19, 2020)

Modified

Jun 17, 2026

Description

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, =13.4, =13.5, <13.5.2.

Vendors: gitlab
Products: gitlab
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.