HIGH

CVE-2018-19584

Gitlab GitLab 2019-07-10 CVSS v3.0

CVSS

7.5

Description

GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups.

Weakness (CWE)

CWE-639 Authorization Bypass (IDOR)

EPSS Score

1.55%

Probability of exploitation in next 30 days

73.8th percentile

References

https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab-ce/issues/52522 Exploit, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE