CVE-2019-10115

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The GitLab Releases feature could allow guest users access to private information like release details and code information.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/Release Notes, Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/56402Exploit, Vendor Advisory
https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/Release Notes, Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/56402Exploit, Vendor Advisory

Timeline

Published: May 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101164.3An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, CVE-2019-101176.1An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9 CVE-2019-101186.1Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.CVE-2019-101199.8eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. CVE-2019-10124.7An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w CVE-2019-101208.8On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achiev CVE-2019-101219.8eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. CVE-2019-101229.8eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 compone CVE-2019-101239.8SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous CVE-2019-101259.8An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expecte CVE-2019-101269.8A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mw CVE-2019-101278.8A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down