6.5

CVE-2018-19583

GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitlab ≫ GitLab SwEdition community Version >= 8.0.0 < 11.3.11
Gitlab ≫ GitLab SwEdition enterprise Version >= 8.0.0 < 11.3.11
Gitlab ≫ GitLab SwEdition community Version >= 11.4.0 < 11.4.8
Gitlab ≫ GitLab SwEdition enterprise Version >= 11.4.0 < 11.4.8
Gitlab ≫ GitLab SwEdition community Version >= 11.5.0 < 11.5.1
Gitlab ≫ GitLab SwEdition enterprise Version >= 11.5.0 < 11.5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.64% 0.733
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
Vendor Advisory
Broken Link
Release Notes
http://www.securityfocus.com/bid/109166
Third Party Advisory
Broken Link
VDB Entry
https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182
Vendor Advisory
Issue Tracking