Path Traversal in GitLab
CVE-2019-19628
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.036 (88.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Gitlab
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_MISC, Release Notes)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-19628?
- CVE-2019-19628 is a critical-severity vulnerability in GitLab, classified under Path Traversal. CVSS score: 9.8/10. Published 2020-01-05.
- How severe is CVE-2019-19628?
- Critical severity. CVSS v3 base score is 9.8 out of 10.