CVE-2019-15731: SSRF
Published Sep 16, 2019
·Updated
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so.
Affected Software
6 affected components
GitLab GitLab>=12.0.0<12.0.8
GitLab GitLab>=12.0.0<12.0.8
GitLab GitLab>=12.1.0<12.1.8
GitLab GitLab>=12.1.0<12.1.8
GitLab GitLab>=12.2.0<12.2.3
GitLab GitLab>=12.2.0<12.2.3
Event History
Sep 16, 2019
CVE Published
via MITRE·04:58 PM
Data Sourced
via MITRE·04:58 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-15731?
CVE-2019-15731 is classified as a medium severity vulnerability affecting sensitive access controls.
2
How do I fix CVE-2019-15731?
To fix CVE-2019-15731, upgrade GitLab to version 12.2.3 or later.
3
Which versions of GitLab are affected by CVE-2019-15731?
CVE-2019-15731 affects GitLab Community and Enterprise Editions from version 12.0 to 12.2.1.
4
What specific issue does CVE-2019-15731 address?
CVE-2019-15731 allows non-members to comment on merge requests in repositories restricted to project members.
5
Is CVE-2019-15731 exploitable remotely?
Yes, CVE-2019-15731 can be exploited remotely by unauthorized users.