CVE-2019-7155: Medium severity gitlab vulnerability
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. A user retains their role within a project in a private group after being removed from the group, if their privileges within the project are different from the group.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7155?
CVE-2019-7155 is considered a high-severity vulnerability due to incorrect access control issues.
How do I fix CVE-2019-7155?
To fix CVE-2019-7155, upgrade GitLab to version 11.5.8 or later for versions 9.x and 10.x, and to version 11.6.6 or later for versions 11.6.x.
What versions are affected by CVE-2019-7155?
CVE-2019-7155 affects GitLab Community and Enterprise Edition versions 9.x, 10.x, 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
Does CVE-2019-7155 allow unauthorized access to projects?
Yes, CVE-2019-7155 allows users to retain their roles in a project after being removed, potentially granting unauthorized access.
Who is impacted by the CVE-2019-7155 vulnerability?
Users of GitLab Community and Enterprise Edition running affected versions are at risk due to CVE-2019-7155.