CVE-2019-9890

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/Release Notes, Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory
https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/Release Notes, Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Release Notes, Vendor Advisory

Timeline

Published: Apr 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-98919.8The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalation and execution of CVE-2019-98926.5An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who CVE-2019-98939.8libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), whic CVE-2019-98947.5A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.CVE-2019-98959.8In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.CVE-2019-98967.8In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same director CVE-2019-98977.5Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.CVE-2019-98989.8Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.CVE-2019-99008.3When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote at CVE-2019-990110.0Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass a CVE-2019-99036.5PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located CVE-2019-99046.5An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in l