CVE-2019-11548 - An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9

Back Back to CVE browser

MEDIUM

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9

Published Sep 9, 2019

5.4

MEDIUM

CVSS 3.1

EPSS 0.71%

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/
x_refsource_CONFIRMRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3219
Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/58505
x_refsource_CONFIRMExploitVendor Advisory

Link	Providers	Tags
https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/		x_refsource_CONFIRMRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3219		Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/58505		x_refsource_CONFIRMExploitVendor Advisory