VulnerabilityModified
CVE-2018-19583
GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.
MEDIUM 6.5EPSS 1.64%
Does this matter?
Lower severity and a low EPSS score (1.64%). Track it; it rarely justifies an emergency change on its own.
Description
GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.64% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-532
- Affected
- gitlab/gitlab
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/109166Broken Link, Third Party Advisory, VDB Entry
- https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Broken Link, Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182Issue Tracking, Vendor Advisory
- http://www.securityfocus.com/bid/109166Broken Link, Third Party Advisory, VDB Entry
- https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Broken Link, Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.