CRITICAL

CVE-2019-9174

Gitlab GitLab 2019-04-17 CVSS v3.0

CVSS

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF.

Summary dbcve.org

A Server-Side Request Forgery (SSRF) vulnerability in GitLab Community and Enterprise Edition versions before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 allows attackers to make the GitLab server make arbitrary HTTP requests to internal or external resources, potentially accessing sensitive internal services.

Mitigation

Upgrade GitLab to version 11.6.10, 11.7.6, or 11.8.1 or later. If immediate upgrade is not possible, restrict outbound network access from the GitLab server and monitor for suspicious internal requests.

Weakness (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

EPSS Score

1.95%

Probability of exploitation in next 30 days

79.3th percentile

References

https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ Release Notes, Vendor Advisory https://about.gitlab.com/blog/categories/releases/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab-ce/issues/55468 Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE