CVE-2019-14942 — Cleartext Transmission of Sensitive Info in Gitlab

CWE-319 — Cleartext Transmission of Sensitive Info4 documents4 sources

Severity

5.9MEDIUMNVD

EPSS

0.1%

top 67.12%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gitlab Debian Gitlab

Timeline

PublishedApr 16

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶NVDgitlab/gitlab12.0.0 — 12.0.6+2

▶debiandebian/gitlab< gitlab 12.6.8-3 (sid)

▶gitlabgitlab/gitlab

🔴Vulnerability Details

GHSA

GHSA-97gm-qxrm-c6w2: An issue was discovered in GitLab Community and Enterprise Edition before 11↗2023-04-16

▶

📋Vendor Advisories

GitLab

CVE-2019-14942: An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages↗2023-04-16

▶

Debian

CVE-2019-14942: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.11....↗2019

▶