PT-2019-18347 · Gitlab+2 · Gitlab Ce/Ee+3

Published 2019-09-09 · Updated 2020-08-24 · CVE-2019-6788

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x before 11.6.6, 11.7.x before 11.7.1

Description The issue allows information disclosure. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the user OAuth token for those services.

Recommendations For GitLab Community and Enterprise Edition versions 11.5.8 and earlier, update to version 11.5.8 or later. For GitLab Community and Enterprise Edition versions 11.6.x before 11.6.6, update to version 11.6.6 or later. For GitLab Community and Enterprise Edition versions 11.7.x before 11.7.1, update to version 11.7.1 or later.

Exploit

Fix

Related Identifiers

CVE-2019-6788

Affected Products

Bitbucket

Github

Gitlab

Gitlab Ce/Ee

References · 9

• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/56663 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-6788 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-6788 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6788 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6788 · Vendor Advisory
• https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6788 · Vendor Advisory
• https://about.gitlab.com/releases/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6788 · Note