Vulnerability CVE-2019-10115


Published: 2019-05-16

Description:
An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The GitLab Releases feature could allow guest users access to private information like release details and code information.

Type:

CWE-275

(Permission Issues)

Vendor: Gitlab
Product: Gitlab 
Version:
9.6.0
9.5.9
9.5.8
9.5.7
9.5.6
9.5.5
9.5.4
9.5.3
9.5.2
9.5.10
9.5.1
9.5.0
9.4.7
9.4.6
9.4.5
9.4.4
9.4.3
9.4.2
9.4.1
9.4.0
9.3.9
9.3.8
9.3.7
9.3.6
9.3.5
9.3.4
9.3.3
9.3.2
9.3.11
9.3.10
9.3.1
9.3.0
9.2.9
9.2.8
9.2.7
9.2.6
9.2.5
9.2.4
9.2.3
9.2.2
9.2.10
9.2.1
9.2.0
9.1.9
9.1.8
9.1.7
9.1.6
9.1.5
9.1.4
9.1.3
9.1.2
9.1.10
9.1.1
9.1.0
9.0.9
9.0.8
9.0.7
9.0.6
9.0.5
9.0.4
9.0.3
9.0.2
9.0.13
9.0.12
9.0.11
9.0.10
9.0.1
9.0.0
8.9.9
8.9.8
8.9.7
8.9.6
8.9.5
8.9.4
8.9.3
8.9.2
8.9.11
8.9.10
8.9.1
8.9.0
8.8.9
8.8.8
8.8.7
8.8.6
8.8.5
8.8.4
8.8.3
8.8.2
8.8.1
8.8.0
8.7.9
8.7.8
8.7.7
8.7.6
8.7.5
8.7.4
8.7.3
8.7.2
8.7.1
8.7.0
See more versions on NVD

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
2.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/
https://about.gitlab.com/blog/categories/releases/
https://gitlab.com/gitlab-org/gitlab-ce/issues/56402

Related CVE
CVE-2019-15729
An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request.
CVE-2019-15740
An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads.
CVE-2019-15739
An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.
CVE-2019-15738
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email.
CVE-2019-15737
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session management.
CVE-2019-15736
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack.
CVE-2019-15734
An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these.
CVE-2019-15733
An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch name could be exposed to unauthorized users.

Copyright 2019, cxsecurity.com

 

Back to Top