CVE-2019-6995: Medium severity gitlab vulnerability

Q: What is the severity of CVE-2019-6995?

CVE-2019-6995 has been classified with a severity rating that indicates potential risk due to improper access control.

Q: How do I fix CVE-2019-6995?

To fix CVE-2019-6995, upgrading to GitLab versions 11.5.8, 11.6.6, or 11.7.1 and later is recommended.

Q: Which GitLab versions are affected by CVE-2019-6995?

CVE-2019-6995 affects GitLab Community and Enterprise Editions from versions 8.x to 11.5.7 and certain versions of 11.x.

Q: What kind of vulnerability is CVE-2019-6995?

CVE-2019-6995 is categorized as an Incorrect Access Control vulnerability impacting project issue comments.

Q: Can locked project issues be commented on due to CVE-2019-6995?

Yes, CVE-2019-6995 allows users to comment on locked project issues due to improper access restrictions.

Published Sep 9, 2019

Updated

An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.

Affected Software

12 affected components

GitLab GitLab>=8.6.0<=8.17.8

GitLab GitLab>=9.0.0<=9.3.7

GitLab GitLab>=10.0.0<=10.8.7

GitLab GitLab>=11.0.0<11.5.8

GitLab GitLab>=11.6.0<11.6.6

GitLab GitLab>=11.7.0<11.7.1

Event History

Sep 9, 2019

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

Description

Frequently Asked Questions

What is the severity of CVE-2019-6995?

CVE-2019-6995 has been classified with a severity rating that indicates potential risk due to improper access control.

How do I fix CVE-2019-6995?

To fix CVE-2019-6995, upgrading to GitLab versions 11.5.8, 11.6.6, or 11.7.1 and later is recommended.

Which GitLab versions are affected by CVE-2019-6995?