PT-2019-9866 · Gitlab · Gitlab Ce/Ee+1

Mark Chao · Published 2019-07-10 · Updated 2023-03-01 · CVE-2018-19583

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.0 up to 11.3.10 GitLab CE/EE versions 11.4 up to 11.4.7 GitLab CE/EE versions 11.5 up to 11.5.0

Description The issue allows administrators with access to the logs to see another user's token, as access tokens are logged in the Workhorse logs.

Recommendations For GitLab CE/EE versions 8.0 up to 11.3.10, update to version 11.3.11 or later. For GitLab CE/EE versions 11.4 up to 11.4.7, update to version 11.4.8 or later. For GitLab CE/EE versions 11.5 up to 11.5.0, update to version 11.5.1 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2018-19583

Affected Products

Gitlab

Gitlab Ce/Ee

References · 10

• https://ubuntu.com/security/CVE-2018-19583 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-19583 · Vendor Advisory
• https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-19583 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19583 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19583 · Security Note
• https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182 · Vendor Advisory
• https://about.gitlab.com/releases/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released · Note
• http://securityfocus.com/bid/109166 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19583 · Note