CVE-2018-19576

HIGH

GitLab CE/EE <11.3.11-11.4.8-11.5.1 - Info Disclosure

Title source: llm
STIX 2.1

Description

GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential.

References (2)

Core 2
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://gitlab.com/gitlab-org/gitlab-ce/issues/51238

Scores

CVSS v3 8.1
EPSS 0.0017
EPSS Percentile 37.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Details

CWE
CWE-284
Status published
Products (1)
gitlab/gitlab 8.6.0 - 11.3.11 (2 CPE variants)
Published Jul 10, 2019
Tracked Since Feb 18, 2026