CVE-2019-5468: High severity GitLab GitLab vulnerability

Q: What is the severity of CVE-2019-5468?

CVE-2019-5468 has been classified as a critical privilege escalation vulnerability.

Q: How do I fix CVE-2019-5468?

To fix CVE-2019-5468, upgrade GitLab to version 12.1.2 or later, 12.0.4 or later, or 11.11.6 or later.

Q: What versions of GitLab are affected by CVE-2019-5468?

CVE-2019-5468 affects GitLab versions prior to 12.1.2, 12.0.4, and 11.11.6.

Q: What is the impact of exploiting CVE-2019-5468?

Exploiting CVE-2019-5468 allows attackers to escalate privileges for blocked accounts through Mattermost slash commands.

Q: Which components are implicated in CVE-2019-5468?

CVE-2019-5468 specifically implicates Mattermost integration within GitLab.

Published Jan 28, 2020

Updated

An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account.

Affected Software

6 affected components

GitLab GitLab>=11.11.0<11.11.6

GitLab GitLab>=12.0.0<12.0.4

GitLab GitLab>=12.1.0<12.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GitLab to a version that resolves this vulnerability.
Fixed in 12.1.2
Upgrade
Upgrade GitLab to a version that resolves this vulnerability.
Fixed in 12.0.4
Upgrade
Upgrade GitLab to a version that resolves this vulnerability.
Fixed in 11.11.6

Event History

Jan 28, 2020

CVE Published

via MITRE·02:44 AM

Data Sourced

via MITRE·02:44 AM

DescriptionWeakness

Data Sourced

via OSV·03:15 AM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2019-5468?

CVE-2019-5468 has been classified as a critical privilege escalation vulnerability.

How do I fix CVE-2019-5468?