CVE-2019-6781: Input Validation
An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6781?
CVE-2019-6781 has been classified as a medium severity vulnerability due to improper input validation.
How do I fix CVE-2019-6781?
To fix CVE-2019-6781, update GitLab to version 11.5.8 or later, 11.6.6 or later, or 11.7.1 or later.
Which versions of GitLab are affected by CVE-2019-6781?
CVE-2019-6781 affects GitLab Community and Enterprise Editions prior to versions 11.5.8, 11.6.6, and 11.7.1.
What impact does CVE-2019-6781 have on GitLab users?
CVE-2019-6781 allows the injection of potentially malicious links into notification emails sent to users.
Is CVE-2019-6781 exploitable remotely?
Yes, CVE-2019-6781 is exploitable remotely as it allows for exploitation through unauthorized profile name changes.