Input validation error in Gitlab Community Edition - CVE-2018-19580
Published: July 10, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30991
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19580
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.
Affected software
Gitlab Community Edition
How to mitigate CVE-2018-19580
Install update from vendor's website.
Gitlab Community Edition - update to 11.5.1