PT-2019-17694 · Gitlab · Gitlab

Mario-Areias · Publicado 2019-09-09 · Atualizado 2023-03-01 · CVE-2019-5471

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 11.11.6 GitLab versions prior to 12.0.4 GitLab versions prior to 12.1.2

Description An issue with input validation and output encoding was found in the email notification feature, potentially leading to a persistent XSS.

Recommendations For versions prior to 11.11.6, update to version 11.11.6 or later. For versions prior to 12.0.4, update to version 12.0.4 or later. For versions prior to 12.1.2, update to version 12.1.2 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-5471

Produtos afetados

Gitlab

Referências · 7

• 🔥 https://hackerone.com/reports/496973 · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab-ee/issues/11515 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5471 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5471 · Nota
• https://osv.dev/vulnerability/CVE-2019-5471 · Aviso do Fabricante
• https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released · Nota
• https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released · Aviso do Fabricante