CVE-2019-6995
First published: Mon Sep 09 2019(Updated: )
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=8.6.0<=8.17.8 | |
| GitLab | >=8.6.0<=8.17.8 | |
| GitLab | >=9.0.0<=9.3.7 | |
| GitLab | >=9.0.0<=9.3.7 | |
| GitLab | >=10.0.0<=10.8.7 | |
| GitLab | >=10.0.0<=10.8.7 | |
| GitLab | >=11.0.0<11.5.8 | |
| GitLab | >=11.0.0<11.5.8 | |
| GitLab | >=11.6.0<11.6.6 | |
| GitLab | >=11.6.0<11.6.6 | |
| GitLab | >=11.7.0<11.7.1 | |
| GitLab | >=11.7.0<11.7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-6995?
CVE-2019-6995 has been classified with a severity rating that indicates potential risk due to improper access control.
How do I fix CVE-2019-6995?
To fix CVE-2019-6995, upgrading to GitLab versions 11.5.8, 11.6.6, or 11.7.1 and later is recommended.
Which GitLab versions are affected by CVE-2019-6995?
CVE-2019-6995 affects GitLab Community and Enterprise Editions from versions 8.x to 11.5.7 and certain versions of 11.x.
What kind of vulnerability is CVE-2019-6995?
CVE-2019-6995 is categorized as an Incorrect Access Control vulnerability impacting project issue comments.
Can locked project issues be commented on due to CVE-2019-6995?
Yes, CVE-2019-6995 allows users to comment on locked project issues due to improper access restrictions.
- agent/references
- agent/type
- agent/author
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/8.6.0
- version/gitlab/8.17.8
- version/gitlab/9.0.0
- version/gitlab/9.3.7
- version/gitlab/10.0.0
- version/gitlab/10.8.7
- version/gitlab/11.0.0
- version/gitlab/11.6.0
- version/gitlab/11.7.0