Main Vulnerability Database Vulnerabilities #VU31098

Server-Side Request Forgery (SSRF) in Gitlab Community Edition - CVE-2019-9174

Published: April 17, 2019 / Updated: July 17, 2020

Vulnerability identifier: #VU31098

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2019-9174

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: GitLab, Inc

Affected software:
Gitlab Community Edition

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF.

Install update from vendor's website.