CVE-2019-5461

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
n/aGitLab Community EditionFix Versions: 12.1.2, 12.0.4, and 11.11.6

References

Timeline

Published
Sep 9, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-54628.8A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has chaCVE-2019-54635.3An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. ThiCVE-2019-54649.8A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF wheCVE-2019-54654.3An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosCVE-2019-54664.3An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.CVE-2019-54675.4An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. CVE-2019-54688.8An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used wiCVE-2019-54696.5An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other CVE-2019-54707.5An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could resulCVE-2019-54715.4An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSSCVE-2019-54727.5An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epCVE-2019-54737.2An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4
CVE-2019-5461: Low severity, CVSS 3.5 | Vulnix