CVE-2018-19576: High severity gitlab vulnerability
GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19576?
CVE-2018-19576 has a high severity rating due to its access control vulnerability that allows unauthorized modifications by Guest users.
How do I fix CVE-2018-19576?
To resolve CVE-2018-19576, upgrade GitLab to version 11.3.11 or later, 11.4.8 or later, or 11.5.1 or later.
Who is affected by CVE-2018-19576?
CVE-2018-19576 affects GitLab CE and EE installations from version 8.6 up to 11.3.11, 11.4 up to 11.4.8, and 11.5 up to 11.5.1.
What type of vulnerability is CVE-2018-19576?
CVE-2018-19576 is classified as an access control issue that allows unauthorized actions on confidential issues.
Can Guest users exploit CVE-2018-19576?
Yes, Guest users can exploit CVE-2018-19576 to change or delete their own comments on confidential issues.