CVE-2018-19583: Medium severity GitLab GitLab vulnerability
GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 11.3.11 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 11.4.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 11.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19583?
CVE-2018-19583 is considered a medium severity vulnerability due to its potential exposure of sensitive access tokens.
How do I fix CVE-2018-19583?
To resolve CVE-2018-19583, upgrade to GitLab versions 11.3.11, 11.4.8, or 11.5.1 or later.
What types of access tokens are logged in CVE-2018-19583?
CVE-2018-19583 involves the logging of user access tokens in the Workhorse logs.
Who is affected by CVE-2018-19583?
Administrators with access to the Workhorse logs in affected versions of GitLab are at risk due to CVE-2018-19583.
What versions of GitLab are vulnerable to CVE-2018-19583?
CVE-2018-19583 affects GitLab Community and Enterprise Editions from version 8.0 up to 11.x before specific versions.