CVE-2018-19584

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/52522Exploit, Vendor Advisory
https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/52522Exploit, Vendor Advisory

Timeline

Published: Jul 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-195857.5GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirrorin CVE-2018-195869.9Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads be CVE-2018-195876.5In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.CVE-2018-195887.2Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control.CVE-2018-195896.5Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows CVE-2018-19597.8IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it use CVE-2018-195917.5In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation o CVE-2018-195927.8The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to CVE-2018-195959.8PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an CVE-2018-195964.8Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506.CVE-2018-195974.8CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.CVE-2018-195984.8Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request.