CVE-2019-5486 — Authentication Bypass Using an Alternate Path or Channel in Gitlab

CWE-288 — Authentication Bypass Using an Alternate Path or Channel CWE-287 — Improper Authentication4 documents4 sources

Severity

8.8HIGHNVD

EPSS

0.0%

top 88.04%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Gitlab Debian Gitlab Gitlab CE EE +1 more

Timeline

PublishedDec 18

Latest updateMay 24

Description

A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

▶NVDgitlab/gitlab12.2.0 — 12.2.6+2

▶debiandebian/gitlab< gitlab 12.6.8-3 (sid)

▶CVEListV5gitlab_ce/ee12.3.2, 12.2.6, and 12.1.10

▶gitlabgitlab/gitlab

▶gitlabgitlab/gitlab_ce

🔴Vulnerability Details

GHSA

GHSA-x79q-qfgr-wrvw: A authentication bypass vulnerability exists in GitLab CE/EE <v12↗2022-05-24

▶

📋Vendor Advisories

GitLab

CVE-2019-5486: A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used↗2019-12-18

▶

Debian

CVE-2019-5486: gitlab - A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6,...↗2019

▶