CVE-2019-5461

3.5LOW

Key Information:

Vendor
Gitlab
Status
Gitlab Community Edition
Vendor
CVE Published:
9 September 2019

Summary

An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.

Affected Version(s)

GitLab Community Edition Fix Versions: 12.1.2, 12.0.4, and 11.11.6

References

https://hackerone.com/reports/446593
x_refsource_MISC
https://gitlab.com//gitlab-org/gitlab-ce/issues/54649
x_refsource_CONFIRM

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.