CVE-2019-12428

2020-03-1014:15:00

Google

osv.dev

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

64.7%

JSON

An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization.

CPENameOperatorVersion
gitlabeq11.11.0-rc5-ee
gitlabeq8.12.0-rc2-ee
gitlabeq8.12.0-rc1
gitlabeq8.11.0-rc3-ee
gitlabeq8.12.0-rc6-ee
gitlabeq11.11.0-rc3-ee
gitlabeq8.8.0-ee
gitlabeq7.1.0
gitlabeq7.4.4-ee
gitlabeq7.2.0.rc3-ee

Name	Operator	Version
gitlab	eq	11.11.0-rc5-ee
gitlab	eq	8.12.0-rc2-ee
gitlab	eq	8.12.0-rc1
gitlab	eq	8.11.0-rc3-ee
gitlab	eq	8.12.0-rc6-ee
gitlab	eq	11.11.0-rc3-ee
gitlab	eq	8.8.0-ee
gitlab	eq	7.1.0
gitlab	eq	7.4.4-ee
gitlab	eq	7.2.0.rc3-ee