Lucene search

HackeroneCVE-2019-5469

HistoryDec 18, 2019 - 9:15 p.m.

CVE-2019-5469

2019-12-1821:15:14

CWE-639

hackerone

web.nvd.nist.gov

cve-2019-5469

idor

vulnerability

gitlab

file replacement

nvd

security

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets.

Affected configurations

Nvd

Vulners

Node

gitlabgitlabRange11.11.0–11.11.6community

gitlabgitlabRange11.11.0–11.11.6enterprise

gitlabgitlabRange12.0.0–12.0.4community

gitlabgitlabRange12.0.0–12.0.4enterprise

gitlabgitlabRange12.1.0–12.1.2community

gitlabgitlabRange12.1.0–12.1.2enterprise

VendorProductVersionCPE
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::community:::*
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

CNA Affected

[
  {
    "product": "GitLab",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed versions 12.1.2, 12.0.4, and 11.11.6"
      }
    ]
  }
]

References

gitlab.com/gitlab-org/gitlab-ce/issues/60551

hackerone.com/reports/534794

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

Related for CVE-2019-5469