PT-2019-14350 · Gitlab+1 · Gitlab Ce/Ee+2

Ethan Strike · Published 2019-09-16 · Updated 2019-09-18 · CVE-2019-15728

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 10.1 through 12.2.1

Description An issue was discovered where protections against SSRF attacks on the Kubernetes integration are insufficient. This could have allowed an attacker to request any local network resource accessible from the GitLab server.

Recommendations For GitLab Community and Enterprise Edition versions 10.1 through 12.2.1, consider restricting access to the Kubernetes integration until a patch is available. As a temporary workaround, limit the exposure of local network resources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2019-15728

Affected Products

Gitlab

Gitlab Ce/Ee

Kubernetes

References · 6

• https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15728 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15728 · Note
• https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released · Note
• https://gitlab.com/gitlab-org/gitlab-ce/issues/61314 · Note