VulnerabilityModified
CVE-2018-19580
All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.
MEDIUM 5.3EPSS 0.99%
Does this matter?
Lower severity and a low EPSS score (0.99%). Track it; it rarely justifies an emergency change on its own.
Description
All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.99% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- gitlab/gitlab
- Source
- cve@mitre.org
References
- https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/39809Issue Tracking, Vendor Advisory
- https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/39809Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.