CRITICAL

CVE-2019-14943

Gitlab GitLab 2019-08-29 CVSS v3.0

CVSS

9.8

Description

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials.

Summary dbcve.org

GitLab Community and Enterprise Edition versions 12.0 through 12.1.4 contain hard-coded credentials embedded in the application code or configuration. These credentials could be discovered and exploited by attackers to gain unauthorized access to the system or its resources.

Mitigation

Upgrade GitLab to a version newer than 12.1.4. Additionally, audit the installation for any unauthorized access and rotate any credentials that may have been exposed.

Weakness (CWE)

CWE-798 Hard-coded Credentials

EPSS Score

Probability of exploitation in next 30 days

79.8th percentile

References

https://about.gitlab.com/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ Vendor Advisory https://about.gitlab.com/blog/categories/releases/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4530 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE