CVE-2019-19312

Опубликовано: 05 янв. 2020

Источник: nvd

CVSS3: 5.8

CVSS2: 5

EPSS Низкий

Описание

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API.

Ссылки

https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
Vendor Advisory
https://about.gitlab.com/blog/categories/releases/
Release Notes
https://gitlab.com/gitlab-org/gitlab/issues/28802
Broken Link
https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
Vendor Advisory
https://about.gitlab.com/blog/categories/releases/
Release Notes
https://gitlab.com/gitlab-org/gitlab/issues/28802
Broken Link

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Версия от 8.14.0 (включая) до 12.3.8 (исключая)

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Версия от 12.4.0 (включая) до 12.4.5 (исключая)

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Версия от 12.5.0 (включая) до 12.5.2 (исключая)

EPSS

Процентиль: 40%

0.00181

Низкий

5.8 Medium

CVSS3

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2019-19312

CVSS3: 5.8

ubuntu

больше 5 лет назад

CVE-2019-19312

CVSS3: 5.8

debian

больше 5 лет назад

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access C ...

GHSA-6955-m4p2-35rh

github

около 3 лет назад

EPSS

Процентиль: 40%

0.00181

Низкий

5.8 Medium

CVSS3

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo