NVD-CWE-noinfo

A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.

In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.

In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call.

In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call.

In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious website by spoofing the content in an error response.

In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.