CVE-2019-11544
First published: Mon Sep 09 2019(Updated: )
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository restrictions will receive emails about restricted events.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=8.1.0<=8.17.8 | |
| GitLab | >=8.1.0<=8.17.8 | |
| GitLab | >=9.0.0<=9.3.7 | |
| GitLab | >=9.0.0<=9.3.7 | |
| GitLab | >=10.0.0<=10.8.7 | |
| GitLab | >=10.0.0<=10.8.7 | |
| GitLab | >=11.0.0<11.8.9 | |
| GitLab | >=11.0.0<11.8.9 | |
| GitLab | >=11.9.0<11.9.10 | |
| GitLab | >=11.9.0<11.9.10 | |
| GitLab | >=11.10.0<=11.10.2 | |
| GitLab | >=11.10.0<11.10.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-11544?
The severity of CVE-2019-11544 is classified as medium, allowing information disclosure for non-member users.
How do I fix CVE-2019-11544?
To fix CVE-2019-11544, upgrade your GitLab instance to version 11.8.9 or later, 11.9.10 or later, or 11.10.2 or later.
Which versions of GitLab are affected by CVE-2019-11544?
CVE-2019-11544 affects GitLab Community and Enterprise Edition versions 8.x through 11.x before the stated fixed versions.
What kind of information can be disclosed by CVE-2019-11544?
CVE-2019-11544 allows unauthorized users to access notifications related to internal projects, potentially exposing sensitive project details.
Is there a vulnerability report for CVE-2019-11544?
Yes, detailed information about CVE-2019-11544 can be found in the GitLab security release notes and issue tracker.
- agent/references
- agent/type
- agent/severity
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/8.1.0
- version/gitlab/8.17.8
- version/gitlab/9.0.0
- version/gitlab/9.3.7
- version/gitlab/10.0.0
- version/gitlab/10.8.7
- version/gitlab/11.0.0
- version/gitlab/11.9.0
- version/gitlab/11.10.0
- version/gitlab/11.10.2