CVE-2019-6797 — Sensitive Information Exposure in Gitlab

4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 68.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedMay 17
Latest updateMay 24

Description

An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitHub token used in CI/CD for External Repos was being leaked to project maintainers in the UI.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDgitlab/gitlab11.6.0 — 11.6.6+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-w2gf-3qqp-3r4x: An information disclosure issue was discovered in GitLab Enterprise Edition before 11↗2022-05-24
▶

📋Vendor Advisories

2
GitLab
CVE-2019-6797: An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitHub↗2019-05-17
▶
Debian
CVE-2019-6797: gitlab - An information disclosure issue was discovered in GitLab Enterprise Edition befo...↗2019
▶