VulnerabilityModified

CVE-2019-6791

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.

MEDIUM 6.5EPSS 0.80%

Does this matter?

Lower severity and a low EPSS score (0.80%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported, it will retain its prior visibility.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.80% probability · 55th percentile
CISA KEV: Not listed
Weakness: CWE-281
Affected: gitlab/gitlab
Source: cve@mitre.org

References

https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Vendor Advisory
https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.