CVE-2019-5474: Medium severity gitlab vulnerability

Q: What is the severity of CVE-2019-5474?

CVE-2019-5474 has been classified with a medium severity due to the potential for unauthorized access to merge request approval rules.

Q: How do I fix CVE-2019-5474?

To fix CVE-2019-5474, upgrade your GitLab EE installation to version 12.1.2 or later, or to 12.0.4 or later, or 11.11.6 or later.

Q: What versions of GitLab are affected by CVE-2019-5474?

CVE-2019-5474 affects GitLab EE versions prior to 12.1.2, 12.0.4, and 11.11.6.

Q: What type of vulnerability is CVE-2019-5474?

CVE-2019-5474 is an authorization issue that allows merge request approval rules to be overridden incorrectly.

Q: Who should be concerned about CVE-2019-5474?

Organizations using vulnerable versions of GitLab EE should prioritize addressing CVE-2019-5474 to maintain appropriate security controls.

Published Jan 28, 2020

Updated

An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.

Affected Software

3 affected components

GitLab GitLab>=11.8.0<11.11.6

GitLab GitLab>=12.0.0<12.0.4

GitLab GitLab>=12.1.0<12.1.2

Remediation

Patch Available

https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/

Event History

Jan 28, 2020

CVE Published

via MITRE·02:29 AM

Data Sourced

via MITRE·02:29 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-5474?

CVE-2019-5474 has been classified with a medium severity due to the potential for unauthorized access to merge request approval rules.

How do I fix CVE-2019-5474?