CVE-2018-19583 — Log File Information Exposure in Gitlab

CWE-532 — Log File Information Exposure5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 62.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedJul 10
Latest updateMay 24

Description

GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶NVDgitlab/gitlab8.0.0 — 11.3.11+2
▶debiandebian/gitlab< gitlab 11.3.11+dfsg-1 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-2826-9vpv-crx3: GitLab CE/EE, versions 8↗2022-05-24
▶
OSV
CVE-2018-19583: GitLab CE/EE, versions 8↗2019-07-10
▶

📋Vendor Advisories

2
GitLab
CVE-2018-19583: GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permi↗2019-07-10
▶
Debian
CVE-2018-19583: gitlab - GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11...↗2018
▶