CVE-2019-5474 An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.
MediumCVSS 6.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitlab | >= 11.8.0, < 11.11.6 | 11.11.6 |
| gitlab | >= 12.0.0, < 12.0.4 | 12.0.4 |
| gitlab | >= 12.1.0, < 12.1.2 | 12.1.2 |
| GitLab EE | = before 12.1.2 | No fix listed |
| GitLab EE | = before 12.0.4 | No fix listed |
| GitLab EE | = before 11.11.6 | No fix listed |
References
- about.gitlab.com patch release-notes vendor-advisory
- gitlab.com exploit vendor-advisory
- hackerone.com permissions-required