CVE-2019-11546: Race Condition
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11546?
CVE-2019-11546 has a medium severity level due to the potential for unauthorized approvals in merge requests.
How do I fix CVE-2019-11546?
To fix CVE-2019-11546, upgrade your GitLab Community or Enterprise Edition to versions 11.8.9, 11.9.10, or 11.10.2 or later.
What impact does CVE-2019-11546 have on GitLab users?
CVE-2019-11546 allows users to potentially approve a merge request multiple times, which can disrupt the intended approval workflow.
Which versions of GitLab are affected by CVE-2019-11546?
CVE-2019-11546 affects GitLab versions before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2.
Is CVE-2019-11546 a local or remote vulnerability?
CVE-2019-11546 is considered a local vulnerability as it requires authenticated users to exploit the race condition.