CVE-2019-12825: Medium severity gitlab vulnerability
Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespace. They are not protected and are available to all other users with no previous access to the repo.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12825?
CVE-2019-12825 is considered a medium severity vulnerability due to the potential for unauthorized access to sensitive Docker registries.
How do I fix CVE-2019-12825?
To mitigate CVE-2019-12825, upgrade GitLab Enterprise to version 12.5.0 or later.
Who is affected by CVE-2019-12825?
CVE-2019-12825 affects GitLab Enterprise versions from 12.0.0-pre to 12.5.0.
What can attackers do with CVE-2019-12825?
Attackers exploiting CVE-2019-12825 can gain unauthorized access to read Docker registries of other groups.
What triggers CVE-2019-12825?
CVE-2019-12825 is triggered when a legitimate user changes the group path, and the Docker registries are not updated accordingly.