CVE-2018-19583
Last modified
CVE-2018-19583 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.. EPSS estimates a 1.64% chance of exploitation in the next 30 days.
Description
GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 8.0.0, < 11.3.11 |
| Gitlab | Gitlab | >= 11.4.0, < 11.4.8 |
| Gitlab | Gitlab | >= 11.5.0, < 11.5.1 |
References
- http://www.securityfocus.com/bid/109166Broken Link, Third Party Advisory, VDB Entry
- https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Broken Link, Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182Issue Tracking, Vendor Advisory
- http://www.securityfocus.com/bid/109166Broken Link, Third Party Advisory, VDB Entry
- https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Broken Link, Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-19583?
How severe is CVE-2018-19583?
How do I fix CVE-2018-19583?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-19577Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 b…5.3
- CVE-2018-19578GitLab EE, version 11.5 before 11.5.1, is vulnerable to an i…
- CVE-2018-19579GitLab EE version 11.5 is vulnerable to a persistent XSS vul…
- CVE-2018-19580All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 …
- CVE-2018-19581GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 befo…
- CVE-2018-19582GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.…
- CVE-2018-19584GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8,…
- CVE-2018-19585GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x…
- CVE-2018-19586Silverpeas 5.15 through 6.0.2 is affected by an authenticate…
- CVE-2018-19587In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c…
- CVE-2018-19588Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Co…
- CVE-2018-19589Incorrect Access Controls of Security Officer (SO) in PKCS11…
Are you affected by CVE-2018-19583?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST