Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespace. They are not protected and are available to all other users with no previous access to the repo.
References
| Link | Resource |
|---|---|
| https://about.gitlab.com/blog/categories/releases/ | Release Notes Vendor Advisory |
| https://atomic111.github.io/article/gitlab-Unauthorized-Access-to-Container-Registry | Third Party Advisory |
| https://about.gitlab.com/blog/categories/releases/ | Release Notes Vendor Advisory |
| https://atomic111.github.io/article/gitlab-Unauthorized-Access-to-Container-Registry | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://about.gitlab.com/blog/categories/releases/ - Release Notes, Vendor Advisory | |
| References | () https://atomic111.github.io/article/gitlab-Unauthorized-Access-to-Container-Registry - Third Party Advisory |
Information
Published : 2020-02-17 14:15
Updated : 2024-11-21 04:23
NVD link : CVE-2019-12825
Mitre link : CVE-2019-12825
CVE.ORG link : CVE-2019-12825
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-922
Insecure Storage of Sensitive Information