MEDIUM

CVE-2019-14942

Gitlab GitLab 2023-04-16 CVSS v3.1

CVSS

5.9

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.

Summary dbcve.org

GitLab Pages with access control was sending authentication cookies over cleartext HTTP instead of HTTPS. This allows network attackers to intercept cookies in transit, potentially gaining unauthorized access to private pages.

Mitigation

Upgrade GitLab to version 11.11.8, 12.0.6, or 12.1.6 or later, or ensure GitLab Pages is configured to only serve over HTTPS.

Weakness (CWE)

CWE-319 Cleartext Transmission

EPSS Score

0.46%

Probability of exploitation in next 30 days

38.9th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ Vendor Advisory https://gitlab.com/gitlab-org/gitlab-pages/issues/232 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE