CVE-2019-6960
Last modified
CVE-2019-6960 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. EPSS estimates a 2.08% chance of exploitation in the next 30 days.
Description
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 9.3.0, <= 9.3.7 |
| Gitlab | Gitlab | >= 10.0.0, <= 10.8.7 |
| Gitlab | Gitlab | >= 11.0.0, < 11.5.8 |
| Gitlab | Gitlab | >= 11.6.0, < 11.6.6 |
| Gitlab | Gitlab | >= 11.7.0, < 11.7.1 |
References
- https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/54357Exploit, Issue Tracking, Third Party Advisory
- https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/54357Exploit, Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-6960?
How severe is CVE-2019-6960?
How do I fix CVE-2019-6960?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-6857A CWE-754: Improper Check for Unusual or Exceptional Conditi…7.5
- CVE-2019-6858A CWE-427:Uncontrolled Search Path Element vulnerability exi…7.8
- CVE-2019-6859A CWE-798: Use of Hardcoded Credentials vulnerability exists…7.5
- CVE-2019-6956An issue was discovered in Freeware Advanced Audio Decoder 2…7.1
- CVE-2019-6957A recently discovered security vulnerability affects all Bos…9.8
- CVE-2019-6958A recently discovered security vulnerability affects all Bos…9.1
- CVE-2019-6961Incorrect access control in actionHandlerUtility.php in the …
- CVE-2019-6962A shell injection issue in cosa_wifi_apis.c in the RDK RDKB-…
- CVE-2019-6963A heap-based buffer overflow in cosa_dhcpv4_dml.c in the RDK…
- CVE-2019-6964A heap-based buffer over-read in Service_SetParamStringValue…
- CVE-2019-6965An XSS issue was discovered in i-doit Open 1.12 via the src/…
- CVE-2019-6966An issue was discovered in Bento4 1.5.1-628. The AP4_ElstAto…
Are you affected by CVE-2019-6960?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST