CVE-2019-6960

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/54357Exploit, Issue Tracking, Third Party Advisory
https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/54357Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Sep 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-69616.5Incorrect access control in actionHandlerUtility.php in the RDK RDKB-20181217-1 WebUI module allows a logged in user to control DDNS, QoS, R CVE-2019-69627.5A shell injection issue in cosa_wifi_apis.c in the RDK RDKB-20181217-1 CcspWifiAgent module allows attackers with login credentials to execu CVE-2019-69638.8A heap-based buffer overflow in cosa_dhcpv4_dml.c in the RDK RDKB-20181217-1 CcspPandM module may allow attackers with login credentials to CVE-2019-69648.8A heap-based buffer over-read in Service_SetParamStringValue in cosa_x_cisco_com_ddns_dml.c of the RDK RDKB-20181217-1 CcspPandM module may CVE-2019-69656.1An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter.CVE-2019-69666.5An issue was discovered in Bento4 1.5.1-628. The AP4_ElstAtom class in Core/Ap4ElstAtom.cpp has an attempted excessive memory allocation rel CVE-2019-69678.8AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.CVE-2019-69686.1The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected.CVE-2019-69697.5The web interface of the D-Link DVA-5592 20180823 is vulnerable to an authentication bypass that allows an unauthenticated user to have acce CVE-2019-69707.5Moodle 3.5.x before 3.5.4 allows SSRF.CVE-2019-69719.8An issue was discovered on TP-Link TL-WR1043ND V2 devices. An attacker can send a cookie in an HTTP authentication packet to the router mana CVE-2019-69727.5An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-force, WordList, or Ra