CVE-2019-7176: Medium severity gitlab vulnerability
An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7176?
CVE-2019-7176 is classified as a medium severity vulnerability due to incorrect access control allowing guest users unexpected access.
How do I fix CVE-2019-7176?
To remediate CVE-2019-7176, update GitLab to versions 11.5.9, 11.6.7, or 11.7.2 or newer.
Which versions of GitLab are affected by CVE-2019-7176?
CVE-2019-7176 affects GitLab Community and Enterprise Editions from version 8.9 through 11.5.8, 11.6.x before 11.6.7, and 11.7.x before 11.7.2.
What type of vulnerability is CVE-2019-7176?
CVE-2019-7176 is an access control vulnerability that allows unauthorized reactions by guests on comments they should not see.
Who is at risk due to CVE-2019-7176?
Users of affected GitLab versions are at risk, as guest users can manipulate comment reactions without proper permissions.