Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-467B7CBE-257D-11E9-8573-001B217B3468 (CVE-2019-6787): Gitlab -- Multiple vulnerabilities

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

FreeBSD: VID-467B7CBE-257D-11E9-8573-001B217B3468 (CVE-2019-6787): Gitlab -- Multiple vulnerabilities

Severity
4
CVSS
(AV:N/AC:L/Au:S/C:P/I:N/A:N)
Published
01/31/2019
Created
03/19/2019
Added
02/01/2019
Modified
06/03/2019

Description

Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.

From VID-467B7CBE-257D-11E9-8573-001B217B3468:

Gitlab reports:

Remote Command Execution via GitLab Pages

Covert Redirect to Steal GitHub/Bitbucket Tokens

Remote Mirror Branches Leaked by Git Transfer Refs

Denial of Service with Markdown

Guests Can View List of Group Merge Requests

Guest Can View Merge Request Titles via System Notes

Persistent XSS via KaTeX

Emails Sent to Unauthorized Users

Hyperlink Injection in Notification Emails

Unauthorized Access to LFS Objects

Trigger Token Exposure

Upgrade Rails to 5.0.7.1 and 4.2.11

Contributed Project Information Visible in Private Profile

Imported Project Retains Prior Visibility Setting

Error disclosure on Project Import

Persistent XSS in User Status

Last Commit Status Leaked to Guest Users

Mitigations for IDN Homograph and RTLO Attacks

Access to Internal Wiki When External Wiki Enabled

User Can Comment on Locked Project Issues

Unauthorized Reaction Emojis by Guest Users

User Retains Project Role After Removal from Private Group

GitHub Token Leaked to Maintainers

Unauthenticated Blind SSRF in Jira Integration

Unauthorized Access to Group Membership

Validate SAML Response in Group SAML SSO

Solution(s)

  • freebsd-upgrade-package-gitlab-ce

References

  • CVE-2019-6787

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;