MEDIUM

CVE-2019-9176

Gitlab GitLab 2019-04-17 CVSS v3.0

CVSS

6.5

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows CSRF.

Summary dbcve.org

A Cross-Site Request Forgery (CSRF) vulnerability in GitLab Community and Enterprise Edition allows authenticated attackers to trick users into performing unintended actions by exploiting the lack of proper CSRF token validation in certain requests.

Mitigation

Upgrade GitLab to version 11.6.10, 11.7.6, 11.8.1 or later to receive the security patch that implements proper CSRF token validation.

Weakness (CWE)

CWE-352 Cross-Site Request Forgery (CSRF)

EPSS Score

0.72%

Probability of exploitation in next 30 days

52.2th percentile

References

https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ Release Notes, Vendor Advisory https://about.gitlab.com/blog/categories/releases/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab-ce/issues/55664 Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE