Information disclosure in Gitlab Community Edition - CVE-2018-19582
Published: July 10, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30993
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19582
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to gain access to sensitive information.
GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user.
Affected software
Gitlab Community Edition
How to mitigate CVE-2018-19582
Install update from vendor's website.
Gitlab Community Edition - update to 11.5.1