Race condition in Gitlab Community Edition - CVE-2018-19572
Published: July 10, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU31001
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19572
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11.
Affected software
Gitlab Community Edition
How to mitigate CVE-2018-19572
Install update from vendor's website.
Gitlab Community Edition - update to 11.5.1