cve-2019-5461
Vulnerability from cvelistv5
Published
2019-09-09 16:57
Modified
2024-08-04 19:54
Severity ?
EPSS score ?
Summary
An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
References
▼ | URL | Tags | |
---|---|---|---|
nvd@nist.gov | https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ | Vendor Advisory | |
support@hackerone.com | https://gitlab.com//gitlab-org/gitlab-ce/issues/54649 | Exploit, Vendor Advisory | |
support@hackerone.com | https://hackerone.com/reports/446593 | Third Party Advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
n/a | GitLab Community Edition |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T19:54:53.487Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://hackerone.com/reports/446593" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://gitlab.com//gitlab-org/gitlab-ce/issues/54649" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "GitLab Community Edition", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Fix Versions: 12.1.2, 12.0.4, and 11.11.6" } ] } ], "descriptions": [ { "lang": "en", "value": "An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance\u0027s internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "Improper Input Validation (CWE-20)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2019-09-09T16:57:15", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://hackerone.com/reports/446593" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://gitlab.com//gitlab-org/gitlab-ce/issues/54649" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2019-5461", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "GitLab Community Edition", "version": { "version_data": [ { "version_value": "Fix Versions: 12.1.2, 12.0.4, and 11.11.6" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance\u0027s internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Improper Input Validation (CWE-20)" } ] } ] }, "references": { "reference_data": [ { "name": "https://hackerone.com/reports/446593", "refsource": "MISC", "url": "https://hackerone.com/reports/446593" }, { "name": "https://gitlab.com//gitlab-org/gitlab-ce/issues/54649", "refsource": "CONFIRM", "url": "https://gitlab.com//gitlab-org/gitlab-ce/issues/54649" } ] } } } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2019-5461", "datePublished": "2019-09-09T16:57:15", "dateReserved": "2019-01-04T00:00:00", "dateUpdated": "2024-08-04T19:54:53.487Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2019-5461\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2019-09-09T17:15:14.003\",\"lastModified\":\"2021-11-03T17:15:48.987\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance\u0027s internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.\"},{\"lang\":\"es\",\"value\":\"Se descubri\u00f3 un problema de comprobaci\u00f3n de entrada en la integraci\u00f3n del servicio GitHub que podr\u00eda resultar en que un atacante pueda realizar peticiones POST arbitrarias en la red interna de una instancia de GitLab. Esta vulnerabilidad se abord\u00f3 en las versiones 12.1.2, 12.0.4 y 11.11.6.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.5,\"baseSeverity\":\"LOW\"},\"exploitabilityScore\":2.1,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"11.11.0\",\"versionEndExcluding\":\"11.11.7\",\"matchCriteriaId\":\"33FB67D6-7874-4224-A89C-BFD3080796DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"11.11.0\",\"versionEndExcluding\":\"11.11.7\",\"matchCriteriaId\":\"0ABDFAF2-C1E3-4416-8E67-1CF2ABA29FEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"12.0.0\",\"versionEndExcluding\":\"12.0.4\",\"matchCriteriaId\":\"62DEEA13-4D2C-436B-9780-983FC707DDF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"12.0.0\",\"versionEndExcluding\":\"12.0.4\",\"matchCriteriaId\":\"595B584B-2A5C-44F6-AC4C-51ACF913C6C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"12.1.0\",\"versionEndExcluding\":\"12.1.2\",\"matchCriteriaId\":\"99659BEC-15D0-4E75-BEBE-727FC32D9B35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"12.1.0\",\"versionEndExcluding\":\"12.1.2\",\"matchCriteriaId\":\"D12A3A81-4A4F-441A-A820-F2D19B1A5C89\"}]}]}],\"references\":[{\"url\":\"https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/\",\"source\":\"nvd@nist.gov\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://gitlab.com//gitlab-org/gitlab-ce/issues/54649\",\"source\":\"support@hackerone.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://hackerone.com/reports/446593\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.