CVE-2019-6797

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitHub token used in CI/CD for External Repos was being leaked to project maintainers in the UI.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Release Notes, Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Release Notes, Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory

Timeline

Published: May 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-67989.8An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a CVE-2019-67995.9An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a ro CVE-2019-68007.5In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scri CVE-2019-68026.1CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in CVE-2019-68036.1typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar.CVE-2019-68046.1An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEdito CVE-2019-68059.8SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter.CVE-2019-68067.5A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium CVE-2019-68077.5A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium w CVE-2019-68089.8A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Prem CVE-2019-68097.5A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior CVE-2019-68108.8CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause