CVE-2019-5471: XSS
Published Sep 9, 2019
·Updated
An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6.
Affected Software
6 affected components
GitLab GitLab>=11.11.0<11.11.7
GitLab GitLab>=11.11.0<11.11.7
GitLab GitLab>=12.0.0<12.0.4
GitLab GitLab>=12.0.0<12.0.4
GitLab GitLab>=12.1.0<12.1.2
GitLab GitLab>=12.1.0<12.1.2
Event History
Sep 9, 2019
CVE Published
via MITRE·05:47 PM
Data Sourced
via MITRE·05:47 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-5471?
CVE-2019-5471 has a medium severity rating due to its potential to allow persistent XSS attacks.
2
How do I fix CVE-2019-5471?
To fix CVE-2019-5471, update GitLab to version 12.1.2, 12.0.4, or 11.11.6 or later.
3
Which GitLab versions are affected by CVE-2019-5471?
CVE-2019-5471 affects GitLab versions from 11.11.0 to 11.11.6 and from 12.0.0 to 12.0.4.
4
What type of attack does CVE-2019-5471 enable?
CVE-2019-5471 enables persistent cross-site scripting (XSS) attacks through the email notification feature.
5
Is CVE-2019-5471 a local or remote vulnerability?
CVE-2019-5471 is considered a remote vulnerability as it can be exploited by an attacker without physical access to the system.