PT-2019-15417 · Gitlab+1 · Gitlab Ce/Ee+2

Published 2019-11-26 · Updated 2019-11-27 · CVE-2019-18460

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.15 through 12.4

Description The issue is related to Incorrect Access Control in the Comments Search feature, which is provided by the Elasticsearch integration.

Recommendations For GitLab Community and Enterprise Edition versions 8.15 through 12.4, update to a version that includes the fix for the Incorrect Access Control issue in the Comments Search feature.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-18460

Affected Products

Elasticsearch

Gitlab

Gitlab Ce/Ee

References · 5

• https://osv.dev/vulnerability/CVE-2019-18460 · Vendor Advisory
• https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released · Vendor Advisory
• https://about.gitlab.com/blog/categories/releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18460 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18460 · Note