PT-2020-11139 · Gitlab · Gitlab

Ashish_R_Padelkar · Published 2020-01-28 · Updated 2020-01-31 · CVE-2019-5472

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gitlab versions prior to 12.1.2 Gitlab versions prior to 12.0.4 Gitlab versions prior to 11.11.6

Description An authorization issue was discovered that prevented owners and maintainers from deleting epic comments.

Recommendations For versions prior to 12.1.2, update to version 12.1.2 or later. For versions prior to 12.0.4, update to version 12.0.4 or later. For versions prior to 11.11.6, update to version 11.11.6 or later.

Exploit

Fix

Improper Privilege Management

Resource Exhaustion

Weakness Enumeration

CWE-269

CWE-400

Related Identifiers

CVE-2019-5472

Affected Products

Gitlab

References · 5

• 🔥 https://gitlab.com/gitlab-org/gitlab-ee/issues/11381 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5472 · Security Note
• https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released · Vendor Advisory
• https://hackerone.com/reports/538101 · Note