4.9

CVE-2020-13341

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer role to perform various deletions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitlab ≫ GitLab SwEditioncommunity Version >= 13.1.0 < 13.2.10
Gitlab ≫ GitLab SwEditionenterprise Version >= 13.1.0 < 13.2.10
Gitlab ≫ GitLab SwEditioncommunity Version >= 13.3.0 < 13.3.7
Gitlab ≫ GitLab SwEditionenterprise Version >= 13.3.0 < 13.3.7
Gitlab ≫ GitLab SwEditioncommunity Version >= 13.4.0 < 13.4.2
Gitlab ≫ GitLab SwEditionenterprise Version >= 13.4.0 < 13.4.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.369
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
cve@gitlab.com 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

https://hackerone.com/reports/960244
Third Party Advisory
Permissions Required