CVE-2018-19582 — Authorization Bypass Through User-Controlled Key in Gitlab

CWE-639 — Authorization Bypass Through User-Controlled Key4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 72.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedJul 10
Latest updateMay 24

Description

GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDgitlab/gitlab11.4.0 — 11.4.8+1
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-phq7-q979-hvg6: GitLab EE, versions 11↗2022-05-24
▶

📋Vendor Advisories

2
GitLab
CVE-2018-19582: GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauth↗2019-07-10
▶
Debian
CVE-2018-19582: gitlab - GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an...↗2018
▶