CVE-2019-5469

MEDIUM

GitLab < 11.11.6, < 12.0.4, < 12.1.2 - Authorization Bypass via Project Archive File Upload

Title source: llm

Description

An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets.

References (2)

Core 2

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://hackerone.com/reports/534794

Exploit, Vendor Advisory x_refsource_misc

https://gitlab.com/gitlab-org/gitlab-ce/issues/60551

Scores

CVSS v3 6.5

EPSS 0.0077

EPSS Percentile 51.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-639

Status published

Products (1)

gitlab/gitlab 11.11.0 - 11.11.6 (2 CPE variants)

Published Dec 18, 2019

Tracked Since Feb 18, 2026