CVE-2018-19582: Medium severity gitlab vulnerability
Published Jul 10, 2019
·Updated
GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user.
Affected Software
2 affected components
GitLab GitLab>=11.4.0<11.4.8
GitLab GitLab>=11.5.0<11.5.1
Event History
Jul 10, 2019
CVE Published
via MITRE·04:45 PM
Data Sourced
via MITRE·04:45 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-19582?
CVE-2018-19582 is classified as a medium severity vulnerability due to the potential for unauthorized access to draft merge request comments.
2
How do I fix CVE-2018-19582?
To fix CVE-2018-19582, upgrade your GitLab EE to version 11.4.8 or 11.5.1 or later.
3
What type of vulnerability is CVE-2018-19582?
CVE-2018-19582 is an insecure direct object reference vulnerability.
4
Who is affected by CVE-2018-19582?
CVE-2018-19582 affects users of GitLab EE versions prior to 11.4.8 and 11.5.1.
5
Can an unauthorized user exploit CVE-2018-19582?
Yes, an unauthorized user can exploit CVE-2018-19582 to publish draft merge request comments from other users.