PT-2020-9344 · Gitlab · Gitlab

Christoph Hartmann + 1 · Published 2020-02-17 · Updated 2020-02-28 · CVE-2019-12825

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GitLab Enterprise version 12.0.0-pre

Description: The issue allows authenticated remote attackers to read Docker registries of other groups. This occurs when a legitimate user changes the path of a group, and the Docker registries are not adapted, leaving them in the old namespace and making them available to all other users with no previous access to the repository.

Recommendations: For GitLab Enterprise version 12.0.0-pre, consider restricting access to the Docker registries until a patch is available to prevent unauthorized access. As a temporary workaround, avoid changing the path of a group to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2019-12825

Affected Products

Gitlab

References · 5

• https://osv.dev/vulnerability/CVE-2019-12825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12825 · Security Note
• https://about.gitlab.com/blog/categories/releases · Vendor Advisory
• https://t.me/cvenotify/1077 · Telegram Post
• https://atomic111.github.io/article/gitlab-Unauthorized-Access-to-Container-Registry · Note