Lucene search

PRIOn knowledge basePRION:CVE-2019-19628

HistoryJan 05, 2020 - 10:15 p.m.

Remote code execution

2020-01-0522:15:00

PRIOn knowledge base

www.prio-n.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.03 Low

EPSS

Percentile

90.6%

JSON

In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions.

CPENameOperatorVersion
gitlabge12.4.0
gitlable12.4.5
gitlabge12.5.0
gitlable12.5.3
gitlabge11.3.0
gitlable12.3.8

Name	Operator	Version
gitlab	ge	12.4.0
gitlab	le	12.4.5
gitlab	ge	12.5.0
gitlab	le	12.5.3
gitlab	ge	11.3.0
gitlab	le	12.3.8

References

about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/

about.gitlab.com/blog/categories/releases/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.03 Low

EPSS

Percentile

90.6%

JSON

Related for PRION:CVE-2019-19628