Cyber Resilience

CVE-2019-14942

Medium

Published: 16 April 2023

Published
16 April 2023
Modified
06 February 2025
KEV Added
Patch
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0011 28.5th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-14942 is a medium-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Gitlab Gitlab. Its CVSS base score is 5.9 (Medium).

Operationally, ranked at the 28.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

gitlab
gitlab
≤ 11.11.8 · ≤ 11.11.8 · 12.0.0 — 12.0.6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-319

Role-based training covers secure transmission methods, mitigating cleartext transmission of sensitive data.

addresses: CWE-319

By requiring documented security controls for information exchanges, the control reduces the risk of cleartext transmission of sensitive data.

addresses: CWE-319

Mapping transmission actions in data flows helps prevent cleartext transmission of sensitive information.

addresses: CWE-319

Settings can enforce secure transmission protocols to prevent cleartext transmission of sensitive data.

addresses: CWE-319

Policy addresses secure transport and handling of media to avoid cleartext transmission of sensitive information.

addresses: CWE-319

Enforces safeguards against cleartext transmission of CUI when data leaves organizational boundaries to external systems.

addresses: CWE-319

Explicit controls and continuous oversight on external system services prevent cleartext transmission of sensitive information over provider-managed channels.

addresses: CWE-319

Key-establishment procedures specify secure distribution channels that preclude cleartext transmission of key material.

References