PT-2019-15417 · Gitlab+1 · Gitlab Ce/Ee+2

Publicado 2019-11-26 · Atualizado 2019-11-27 · CVE-2019-18460

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.15 through 12.4

Description The issue is related to Incorrect Access Control in the Comments Search feature, which is provided by the Elasticsearch integration.

Recommendations For GitLab Community and Enterprise Edition versions 8.15 through 12.4, update to a version that includes the fix for the Incorrect Access Control issue in the Comments Search feature.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-18460

Produtos afetados

Elasticsearch

Gitlab

Gitlab Ce/Ee

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-18460 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18460 · Nota
• https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released · Aviso do Fabricante
• https://about.gitlab.com/blog/categories/releases · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18460 · Nota de Segurança