CVE Vulnerability

CVE-2019-6781

An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/ Release Notes Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/22076
Configurations

Configuration 1

cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Information

Published : 2019-05-17 04:29

Updated : 2020-08-24 05:37

NVD link : CVE-2019-6781

Mitre link : CVE-2019-6781

Products Affected
No products.
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')