PT-2020-10132 · Gitlab · Gitlab Ce/Ee+1

Ngalog · Published 2020-01-05 · Updated 2021-07-21 · CVE-2019-19312

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.14 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6

Description The issue concerns incorrect access control. After a project is changed to private, previously forked repositories can still access information about the private project through the API.

Recommendations For GitLab EE versions 8.14 through 12.5, consider restricting access to the API until a fix is available. For GitLab EE version 12.4.3, restrict access to the API to minimize the risk of exploitation. For GitLab EE version 12.3.6, avoid using the API to access private project information until the issue is resolved. As a temporary workaround, consider disabling API access to private projects until a patch is available.

Fix

Related Identifiers

CVE-2019-19312

Affected Products

Gitlab

Gitlab Ce/Ee

References · 5

• https://osv.dev/vulnerability/CVE-2019-19312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19312 · Security Note
• https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released · Vendor Advisory
• https://about.gitlab.com/blog/categories/releases · Note
• https://gitlab.com/gitlab-org/gitlab/issues/28802 · Note