CVE-2018-19496 — Improper Access Control in Gitlab

CWE-284 — Improper Access Control4 documents4 sources

Severity

6.5MEDIUMNVD

EPSS

0.1%

top 75.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gitlab Debian Gitlab

Timeline

PublishedJul 10

Latest updateMay 24

Description

An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privileges to promote a project milestone to a group milestone.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDgitlab/gitlab10.0.0 — 11.3.11+2

▶debiandebian/gitlab< gitlab 11.3.11+dfsg-1 (sid)

▶gitlabgitlab/gitlab

🔴Vulnerability Details

GHSA

GHSA-w3fw-23jp-3855: An issue was discovered in GitLab Community and Enterprise Edition 10↗2022-05-24

▶

📋Vendor Advisories

GitLab

CVE-2018-19496: An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There↗2019-07-10

▶

Debian

CVE-2018-19496: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x...↗2018

▶