vulnerability
FreeBSD: VID-1AA7A094-1147-11EA-B537-001B217B3468 (CVE-2019-19254): Gitlab -- Multiple Vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:P/I:N/A:N) | 2019-11-27 | 2019-11-28 | 2020-01-22 |
Description
Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.
From VID-1AA7A094-1147-11EA-B537-001B217B3468:
Gitlab reports:
Path traversal with potential remote code execution
Private objects exposed through project import
Disclosure of notes via Elasticsearch integration
Disclosure of comments via Elasticsearch integration
DNS Rebind SSRF in various chat notifications
Disclosure of vulnerability status in dependency list
Disclosure of commit count in Cycle Analytics
Exposure of related branch names
Tags pushes from blocked users
Branches and Commits exposed to Guest members via integration
IDOR when adding users to protected environments
Former project members able to access repository information
Unauthorized access to grafana metrics
Todos created for former project members
Update Mattermost dependency
Disclosure of AWS secret keys on certain Admin pages
Stored XSS in Group and User profile fields
Forked project information disclosed via Project API
Denial of Service in the issue and commit comment pages
Tokens stored in plaintext
Solution
References
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.