CVE-2019-5466
published 2020-01-28CVE-2019-5466: An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
PriorityP419medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.97%
57.5th percentile
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 12.6.8-3 (sid) | gitlab 12.6.8-3 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 11.5.0 < 11.11.7 | 11.11.7 |
| gitlab | gitlab_ce | — | — |
| gitlab_ce | ee | — | — |
| gitlab_ce | ee | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8c93-42cq-rfjj: An IDOR was discovered in GitLab CE/EE 11
ghsa_unreviewed·2022-05-24
CVE-2019-5466 [MEDIUM] CWE-639 GHSA-8c93-42cq-rfjj: An IDOR was discovered in GitLab CE/EE 11
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
GitLab
CVE-2019-5466: An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
vendor_gitlab·2020-01-28·CVSS 4.3
CVE-2019-5466 [MEDIUM] CWE-639 CVE-2019-5466: An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
CVE-2019-5466: An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
Debian
CVE-2019-5466: gitlab - An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge req...
vendor_debian·2019·CVSS 4.3
CVE-2019-5466 [MEDIUM] CVE-2019-5466: gitlab - An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge req...
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
Scope: local
sid: resolved (fixed in 12.6.8-3)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/https://gitlab.com/gitlab-org/gitlab-ce/issues/59809https://hackerone.com/reports/507113https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/https://gitlab.com/gitlab-org/gitlab-ce/issues/59809https://hackerone.com/reports/507113
2020-01-28
Published