FKIE_CVE-2019-15728
Vulnerability from fkie_nvd - Published: 2019-09-16 17:15 - Updated: 2024-11-21 04:29
Severity ?
Summary
An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/ | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://gitlab.com/gitlab-org/gitlab-ce/issues/61314 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/ | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.com/gitlab-org/gitlab-ce/issues/61314 | Broken Link |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"matchCriteriaId": "69ED47DA-AAEA-4F30-8BED-D578600D0E96",
"versionEndExcluding": "12.0.8",
"versionStartIncluding": "10.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "6B419121-58BB-44DB-BF37-F8D285F457A3",
"versionEndExcluding": "12.0.8",
"versionStartIncluding": "10.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"matchCriteriaId": "BE0BA50B-833E-4F74-95CB-EC8963B0ABCA",
"versionEndExcluding": "12.1.8",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "36F29405-3C84-4ECF-96B7-E25D88926B46",
"versionEndExcluding": "12.1.8",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"matchCriteriaId": "16FD6BD6-8B76-4053-81C1-E9B00F279113",
"versionEndExcluding": "12.2.3",
"versionStartIncluding": "12.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "F131A404-4B2B-4F77-981B-A12D8FC7F590",
"versionEndExcluding": "12.2.3",
"versionStartIncluding": "12.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en GitLab Community and Enterprise Edition versiones 10.1 hasta 12.2.1. Las protecciones contra ataques de tipo SSRF en la integraci\u00f3n de Kubernetes son insuficientes, lo que podr\u00eda haber permitido a un atacante solicitar cualquier recurso de red local accesible desde el servidor GitLab."
}
],
"id": "CVE-2019-15728",
"lastModified": "2024-11-21T04:29:20.777",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-09-16T17:15:13.900",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/61314"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/61314"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…