CVE-2019-11546 — Race Condition in Gitlab

CWE-362 — Race Condition4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 78.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedSep 9
Latest updateMay 24

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages3 packages

▶NVDgitlab/gitlab8.6.0 — 11.8.9+2
▶debiandebian/gitlab< gitlab 11.8.9+dfsg-1 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-jc6h-6j87-fx8m: An issue was discovered in GitLab Community and Enterprise Edition before 11↗2022-05-24
▶

📋Vendor Advisories

2
GitLab
CVE-2019-11546: An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Con↗2019-09-09
▶
Debian
CVE-2019-11546: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9...↗2019
▶