CVE-2018-19582

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ee/issues/8180Vendor Advisory
https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ee/issues/8180Vendor Advisory

Timeline

Published: Jul 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-195836.5GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse l CVE-2018-195847.5GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vu CVE-2018-195857.5GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirrorin CVE-2018-195869.9Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads be CVE-2018-195876.5In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.CVE-2018-195887.2Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control.CVE-2018-195896.5Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows CVE-2018-19597.8IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it use CVE-2018-195917.5In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation o CVE-2018-195927.8The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to CVE-2018-195959.8PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an CVE-2018-195964.8Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506.