Improper Authorization in Gitlab Community Edition - CVE-2018-19581
Published: July 10, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30992
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19581
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that allows a Guest user to set the weight of an issue they create.
Affected software
Gitlab Community Edition
How to mitigate CVE-2018-19581
Install update from vendor's website.
Gitlab Community Edition - update to 11.5.1