CVE-2019-14942: 
GitLab vulnerability analysis and mitigation

A security vulnerability (CVE-2019-14942) was discovered in GitLab Community and Enterprise Edition affecting versions before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. The vulnerability was internally discovered by the GitLab Security Team and disclosed on August 12, 2019 (GitLab Advisory).

The vulnerability involves authentication cookies for GitLab Pages with Access Control being transmitted over cleartext HTTP, making them vulnerable to Man-In-The-Middle attacks. The issue has been assigned a CVSS v3.1 Base Score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with high attack complexity (NVD).

The vulnerability could allow attackers to intercept authentication cookies transmitted over unencrypted connections, potentially leading to unauthorized access to GitLab Pages content that should be restricted by access controls (GitLab Advisory).

GitLab has addressed this vulnerability in versions 11.11.8, 12.0.6, and 12.1.6. Users are strongly recommended to upgrade to these or later versions immediately to protect against this security issue (GitLab Advisory).