PT-2020-9319 · Gitlab · Gitlab Ce/Ee+1

Peter Marko · Published 2020-03-10 · Updated 2020-03-10 · CVE-2019-12433

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.7 through 11.11

Description: The issue is related to improper input validation, allowing the creation of internal projects in private groups with restricted visibility settings. This leads to multiple permission issues.

Recommendations: For GitLab Community and Enterprise Edition versions 11.7 through 11.11, consider restricting the creation of internal projects in private groups until a fix is available. As a temporary workaround, review and adjust the visibility settings of existing internal projects in private groups to minimize permission issues. Restrict access to sensitive data within these projects to prevent unauthorized access.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-12433

Affected Products

Gitlab

Gitlab Ce/Ee

References · 5

• https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released · Vendor Advisory
• https://about.gitlab.com/blog/categories/releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12433 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12433 · Security Note
• https://t.me/cvenotify/1450 · Telegram Post