CVE-2019-6996
First published: Mon Sep 09 2019(Updated: )
An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership of private groups.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=10.6.0<=10.8.7 | |
| GitLab | >=10.6.0<=10.8.7 | |
| GitLab | >=11.0.0<11.5.8 | |
| GitLab | >=11.0.0<11.5.8 | |
| GitLab | >=11.6.0<11.6.6 | |
| GitLab | >=11.6.0<11.6.6 | |
| GitLab | >=11.7.0<11.7.1 | |
| GitLab | >=11.7.0<11.7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-6996?
CVE-2019-6996 is rated as a medium severity vulnerability due to its incorrect access control that allows project maintainers to view restricted information.
How do I fix CVE-2019-6996?
To fix CVE-2019-6996, upgrade your GitLab instance to version 11.5.8 or later.
Which versions of GitLab are affected by CVE-2019-6996?
CVE-2019-6996 affects GitLab Enterprise Edition versions 10.x (starting from 10.6) and 11.x before 11.5.8, along with specific ranges up to 11.7.1.
What type of vulnerability is CVE-2019-6996?
CVE-2019-6996 is classified as an Incorrect Access Control vulnerability.
What functionality is compromised by CVE-2019-6996?
CVE-2019-6996 compromises the merge request approvers section by allowing unauthorized visibility of project membership.
- agent/references
- agent/type
- agent/weakness
- agent/author
- agent/severity
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/10.6.0
- version/gitlab/10.8.7
- version/gitlab/11.0.0
- version/gitlab/11.6.0
- version/gitlab/11.7.0