CVE-2019-7176
First published: Mon Sep 09 2019(Updated: )
An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=8.9.0<=8.17.8 | |
| GitLab | >=8.9.0<=8.17.8 | |
| GitLab | >=9.0.0<=9.5.10 | |
| GitLab | >=9.0.0<=9.5.10 | |
| GitLab | >=10.0.0<=10.8.6 | |
| GitLab | >=10.0.0<=10.8.6 | |
| GitLab | >=11.0.0<11.5.9 | |
| GitLab | >=11.0.0<11.5.9 | |
| GitLab | >=11.6.0<11.6.7 | |
| GitLab | >=11.6.0<11.6.7 | |
| GitLab | >=11.7.0<11.7.2 | |
| GitLab | >=11.7.0<11.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-7176?
CVE-2019-7176 is classified as a medium severity vulnerability due to incorrect access control allowing guest users unexpected access.
How do I fix CVE-2019-7176?
To remediate CVE-2019-7176, update GitLab to versions 11.5.9, 11.6.7, or 11.7.2 or newer.
Which versions of GitLab are affected by CVE-2019-7176?
CVE-2019-7176 affects GitLab Community and Enterprise Editions from version 8.9 through 11.5.8, 11.6.x before 11.6.7, and 11.7.x before 11.7.2.
What type of vulnerability is CVE-2019-7176?
CVE-2019-7176 is an access control vulnerability that allows unauthorized reactions by guests on comments they should not see.
Who is at risk due to CVE-2019-7176?
Users of affected GitLab versions are at risk, as guest users can manipulate comment reactions without proper permissions.
- agent/references
- agent/type
- agent/author
- agent/severity
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/8.9.0
- version/gitlab/8.17.8
- version/gitlab/9.0.0
- version/gitlab/9.5.10
- version/gitlab/10.0.0
- version/gitlab/10.8.6
- version/gitlab/11.0.0
- version/gitlab/11.6.0
- version/gitlab/11.7.0