Medium severity6.5NVD Advisory· Published Nov 17, 2020· Updated Jun 17, 2026
CVE-2020-13351
CVE-2020-13351
Description
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are >=13.0, <13.3.9,>=13.4.0, <13.4.5,>=13.5.0, <13.5.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=13.0.0,<13.3.9
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=13.0.0,<13.3.9
- Range: >=13.0, <13.3.9,>=13.4.0, <13.4.5,>=13.5.0, <13.5.2
- Range: >=13.0, <13.3.9,>=13.4.0, <13.4.5,>=13.5.0, <13.5.2
- Range: >=13.0
Patches
Vulnerability mechanics
References
3- gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13351.jsonnvdVendor Advisory
- hackerone.com/reports/962462nvdPermissions RequiredThird Party Advisory
- gitlab.com/gitlab-org/gitlab/-/issues/239369nvdBroken Link
News mentions
0No linked articles in our index yet.