CVE-2019-13121 — Server-Side Request Forgery in Gitlab

CWE-918 — Server-Side Request Forgery4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 72.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian GitlabGitlab
Timeline
PublishedMar 10
Latest updateMay 24

Description

An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/gitlab< gitlab 12.6.8-3 (sid)
▶NVDgitlab/gitlab10.6.0 — 12.0.2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-h2w4-xw94-vcj3: An issue was discovered in GitLab Enterprise Edition 10↗2022-05-24
▶

📋Vendor Advisories

2
GitLab
CVE-2019-13121: An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which↗2020-03-10
▶
Debian
CVE-2019-13121: gitlab - An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The Gi...↗2019
▶