CVE-2019-9756

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control, a different vulnerability than CVE-2019-9732.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Product, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/54243Exploit, Vendor Advisory
https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Product, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/54243Exploit, Vendor Advisory

Timeline

Published: Apr 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-97577.5An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or CVE-2019-97585.4An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators f CVE-2019-97599.8An issue was discovered in TONGDA Office Anywhere 10.18.190121. There is a SQL Injection vulnerability via the general/approve_center/list/i CVE-2019-97609.8FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-controlled machine that CVE-2019-97617.5An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authenticat CVE-2019-97629.8A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need CVE-2019-97636.1An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an '<object data="data:text/html' substring in an e-mail CVE-2019-97647.4HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if ve CVE-2019-97656.1In Blog_mini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails() function, related to app/templ CVE-2019-97667.8Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to execute arbitrary co CVE-2019-97677.8Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to execute arbitrary co CVE-2019-97687.5Thinkst Canarytokens through commit hash 4e89ee0 (2019-03-01) relies on limited variation in size, metadata, and timestamp, which makes it e