Improper Authorization in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2019-18458
Published: December 3, 2019
Vulnerability identifier: #VU23353
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-18458
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: GitLab, Inc
Affected software:
Gitlab Community Edition
GitLab Enterprise Edition
Gitlab Community Edition
GitLab Enterprise Edition
Detailed vulnerability description
The vulnerability allows an attacker to bypass authorization checks.
The vulnerability exists due to improper authorization checks for transfer projects to another group feature. A remote user with developer rights can move projects.
How to mitigate CVE-2019-18458
Install updates from vendor's website.