GitLab Community Edition/Enterprise Edition up to 11.10.1 Notifications information disclosure

Summaryinfo

A vulnerability classified as problematic has been found in GitLab Community Edition and Enterprise Edition up to 11.10.1. This vulnerability affects unknown code of the component Notifications. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2019-11544. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in GitLab Community Edition and Enterprise Edition up to 11.10.1 (Bug Tracking Software). It has been classified as problematic. This affects some unknown processing of the component Notifications. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository restrictions will receive emails about restricted events.

The weakness was released 09/09/2019 (Website). The advisory is shared at about.gitlab.com. This vulnerability is uniquely identified as CVE-2019-11544 since 04/25/2019. It is possible to initiate the attack remotely. Required for exploitation is a authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 11.8.9, 11.9.10 or 11.10.2 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-141442, VDB-141443, VDB-141444 and VDB-141445. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitLab

Name

• Community Edition
• Enterprise Edition

Version

• 8.x
• 9.x
• 10.x
• 11.8.0
• 11.8.1
• 11.8.2
• 11.8.3
• 11.8.4
• 11.8.5
• 11.8.6
• 11.8.7
• 11.8.8
• 11.9.0
• 11.9.1
• 11.9.2
• 11.9.3
• 11.9.4
• 11.9.5
• 11.9.6
• 11.9.7
• 11.9.8
• 11.9.9
• 11.10.0
• 11.10.1

License

• open-source

Website

• Vendor: https://gitlab.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion