MEDIUM
CVE-2019-13009
CVSS
6.5
Description
An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Access Control.
Summary dbcve.org
GitLab versions 9.2 through 12.0.2 contained an Incorrect Access Control vulnerability where files uploaded to unsaved personal snippets had improper permission settings, allowing unauthorized users to access files that should have been restricted to the snippet owner.
Mitigation
Upgrade GitLab to version 12.0.3 or later. Until patched, restrict access to personal snippet functionality or implement additional access controls at the network layer.
Weakness (CWE)
CWE-400
Uncontrolled Resource Consumption
CWE-732
Incorrect Permission Assignment
EPSS Score
0.84%
Probability of exploitation in next 30 days
56.4th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.