PT-2019-11572 · Gitlab · Gitlab Ce/Ee+1

Rgupt · Published 2019-05-15 · Updated 2019-05-16 · CVE-2019-10109

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.7.8 and earlier, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 GitLab Community and Enterprise Edition versions 11.7.10 and earlier, 11.8.x before 11.8.6, and 11.9.x before 11.9.4

Description: An Information Exposure issue was discovered in GitLab Community and Enterprise Edition. EXIF geolocation data were not removed from images when uploaded to GitLab. As a result, anyone with access to the uploaded image could obtain its geolocation, device, and software version data (if present).

Recommendations: For versions 11.7.8 and earlier, 11.8.x before 11.8.4, and 11.9.x before 11.9.2, update to version 11.7.8 or later, 11.8.4 or later, and 11.9.2 or later respectively. For versions 11.7.10 and earlier, 11.8.x before 11.8.6, and 11.9.x before 11.9.4, update to version 11.7.10 or later, 11.8.6 or later, and 11.9.4 or later respectively.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-10109

Affected Products

Gitlab

Gitlab Ce/Ee

References · 9

• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/54220 · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/55469 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10109 · Vendor Advisory
• https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10109 · Security Note
• https://about.gitlab.com/blog/categories/releases · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10109 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10109 · Security Note