CVE-2019-9732

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2019/03/14/gitlab-11-8-2-released/Release Notes, Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
https://about.gitlab.com/2019/03/14/gitlab-11-8-2-released/Release Notes, Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory

Timeline

Published: May 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-97339.8An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account CVE-2019-97347.5Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration paramet CVE-2019-97356.5An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x CVE-2019-97366.1DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.CVE-2019-97376.1Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.CVE-2019-97386.1jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.CVE-2019-97406.1An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the at CVE-2019-97416.1An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by th CVE-2019-97427.5gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FI CVE-2019-97438.8An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices. Command injection can occur in the WebHMI component CVE-2019-97448.8An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and FL NAT SMN 8TX-M-DMG devices. There is una CVE-2019-97457.8CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with