Vulnerability Details : CVE-2019-6960
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.
Products affected by CVE-2019-6960
- Gitlab » Gitlab » Community EditionVersions from including (>=) 9.3.0 and up to, including, (<=) 9.3.7cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
- Gitlab » Gitlab » Enterprise EditionVersions from including (>=) 9.3.0 and up to, including, (<=) 9.3.7cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
- Gitlab » Gitlab » Enterprise EditionVersions from including (>=) 10.0.0 and up to, including, (<=) 10.8.7cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
- Gitlab » Gitlab » Community EditionVersions from including (>=) 10.0.0 and up to, including, (<=) 10.8.7cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-6960
0.28%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 68 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-6960
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
References for CVE-2019-6960
-
https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
GitLab Security Release: 11.7.3, 11.6.8, 11.5.10 | GitLabRelease Notes;Vendor Advisory
-
https://gitlab.com/gitlab-org/gitlab-ce/issues/54357
Access to internal wiki when using external wiki service (even when wiki is disabled) (#54357) · Issues · GitLab.org / GitLab FOSS · GitLabExploit;Issue Tracking;Third Party Advisory
Jump to