PT-2019-18347 · Gitlab+2 · Gitlab Ce/Ee+3

Publicado 2019-09-09 · Atualizado 2020-08-24 · CVE-2019-6788

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x before 11.6.6, 11.7.x before 11.7.1

Description The issue allows information disclosure. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the user OAuth token for those services.

Recommendations For GitLab Community and Enterprise Edition versions 11.5.8 and earlier, update to version 11.5.8 or later. For GitLab Community and Enterprise Edition versions 11.6.x before 11.6.6, update to version 11.6.6 or later. For GitLab Community and Enterprise Edition versions 11.7.x before 11.7.1, update to version 11.7.1 or later.

Exploit

Correção

Identificadores relacionados

CVE-2019-6788

Produtos afetados

Bitbucket

Github

Gitlab

Gitlab Ce/Ee

Referências · 9

• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/56663 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-6788 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2019-6788 · Nota de Segurança
• https://about.gitlab.com/releases/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released · Nota
• https://osv.dev/vulnerability/CVE-2019-6788 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6788 · Aviso do Fabricante
• https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-6788 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6788 · Nota