CVE-2020-13351
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipe...
Original description
The description as published by the source.
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are >=13.0, <13.3.9,>=13.4.0, <13.4.5,>=13.5.0, <13.5.2.
Affected packages
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"13.5.2"}]}]
References
- advisory gitlab.com
- advisory hackerone.com
- web gitlab.com
- web nvd.nist.gov