PT-2019-14352 · Gitlab+1 · Gitlab Ce/Ee+2

Felipe Cardozo · Publicado 2019-09-16 · Atualizado 2019-09-18 · CVE-2019-15730

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.14 through 12.2.1

Description An issue was discovered in the Jira integration, which contains a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability is a result of a bypass of the current protection mechanisms against this type of attack. It would allow sending requests to any resources accessible in the local network by the GitLab server.

Recommendations For GitLab Community and Enterprise Edition versions 8.14 through 12.2.1, consider disabling the Jira integration as a temporary workaround until a patch is available. Restrict access to the Jira integration module to minimize the risk of exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2019-15730

Produtos afetados

Gitlab

Gitlab Ce/Ee

Jira

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15730 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15730 · Nota de Segurança
• https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released · Nota
• https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released · Aviso do Fabricante
• https://gitlab.com/gitlab-org/gitlab-ce/issues/61349 · Nota
• https://osv.dev/vulnerability/CVE-2019-15730 · Aviso do Fabricante