CVE-2018-19584 — Authorization Bypass Through User-Controlled Key in Gitlab

CWE-639 — Authorization Bypass Through User-Controlled Key4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 58.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedJul 10
Latest updateMay 24

Description

GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDgitlab/gitlab11.0.0 — 11.3.11+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-m9c3-9q65-f749: GitLab EE, versions 11↗2022-05-24
▶

📋Vendor Advisories

2
GitLab
CVE-2018-19584: GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerabilit↗2019-07-10
▶
Debian
CVE-2018-19584: gitlab - GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11....↗2018
▶