CVE-2019-13121

An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://about.gitlab.com/blog/categories/releases/	Release Notes Vendor Advisory
https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

History

No history.

Information

Published : 2020-03-10 18:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-13121

Mitre link : CVE-2019-13121

CVE.ORG link : CVE-2019-13121

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2019-13121", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-03-10T18:15:11.623", "references": [{"url": "https://about.gitlab.com/blog/categories/releases/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control."}, {"lang": "es", "value": "Se detect\u00f3 un problema en GitLab Enterprise Edition versiones 10.6 hasta la versi\u00f3n 12.0.2. La integraci\u00f3n del proyecto de GitHub era vulnerable a una vulnerabilidad de tipo SSRF que permit\u00eda a un atacante realizar peticiones a recursos de red local. Presenta un Control de Acceso Incorrecto."}], "lastModified": "2020-03-11T20:36:20.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A953B9BF-CA2B-4804-A33E-FA75986AA529", "versionEndIncluding": "12.0.2", "versionStartIncluding": "10.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}