CVE-2019-6781: Input Validation
First published: Fri May 17 2019(Updated: )
An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=11.5.0<11.5.10 | |
| GitLab | >=11.5.0<11.5.10 | |
| GitLab | >=11.6.0<11.6.8 | |
| GitLab | >=11.6.0<11.6.8 | |
| GitLab | >=11.7.0<11.7.3 | |
| GitLab | >=11.7.0<11.7.3 | |
| GitLab | ||
| GitLab |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-6781?
CVE-2019-6781 has been classified as a medium severity vulnerability due to improper input validation.
How do I fix CVE-2019-6781?
To fix CVE-2019-6781, update GitLab to version 11.5.8 or later, 11.6.6 or later, or 11.7.1 or later.
Which versions of GitLab are affected by CVE-2019-6781?
CVE-2019-6781 affects GitLab Community and Enterprise Editions prior to versions 11.5.8, 11.6.6, and 11.7.1.
What impact does CVE-2019-6781 have on GitLab users?
CVE-2019-6781 allows the injection of potentially malicious links into notification emails sent to users.
Is CVE-2019-6781 exploitable remotely?
Yes, CVE-2019-6781 is exploitable remotely as it allows for exploitation through unauthorized profile name changes.
- agent/references
- agent/type
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/first-publish-date
- agent/severity
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/gitlab
- canonical/gitlab
- version/gitlab/11.5.0
- version/gitlab/11.6.0
- version/gitlab/11.7.0