CVEvulnerability
CVE-2018-19583
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-07-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-532
Description
GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.
Affected configurations
• gitlab gitlab (>= 8.0.0 < 11.3.11)
• gitlab gitlab (>= 11.4.0 < 11.4.8)
• gitlab gitlab (>= 11.5.0 < 11.5.1)
Related
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness
References
- http://www.securityfocus.com/bid/109166 Broken Link, Third Party Advisory, VDB Entry
- https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ Broken Link, Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182 Issue Tracking, Vendor Advisory
- http://www.securityfocus.com/bid/109166 Broken Link, Third Party Advisory, VDB Entry
- https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ Broken Link, Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182 Issue Tracking, Vendor Advisory