Server-Side Request Forgery (SSRF) Affecting gitlab package, versions <11.3.11+dfsg-1
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.11% (46th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIANUNSTABLE-GITLAB-317266
- published 2 Dec 2018
- disclosed 10 Jul 2019
Introduced: 2 Dec 2018
CVE-2018-19571 Open this link in a new tabHow to fix?
Upgrade Debian:unstable
gitlab
to version 11.3.11+dfsg-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream gitlab
package and not the gitlab
package as distributed by Debian
.
See How to fix?
for Debian:unstable
relevant fixed versions and status.
GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks.
References
- https://security-tracker.debian.org/tracker/CVE-2018-19571
- http://packetstormsecurity.com/files/160516/GitLab-11.4.7-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/160699/GitLab-11.4.7-Remote-Code-Execution.html
- https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
- https://gitlab.com/gitlab-org/gitlab-ce/issues/53242
- https://www.exploit-db.com/exploits/49263
CVSS Scores
version 3.1