VulnerabilityModified

CVE-2019-5883

The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to.

CRITICAL 9.1EPSS 1.50%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to.

CVSS 3.0: 9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 1.50% probability · 73th percentile
CISA KEV: Not listed
Affected: gitlab/gitlab
Source: cve@mitre.org

References

https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Vendor Advisory
https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.