CVE-2019-15581 - An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules

Back Back to CVE browser

MEDIUM

An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules

Published Jan 28, 2020

5.3

MEDIUM

CVSS 3.1

EPSS 0.97%

Description

An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules.

Affected products

Vendor GitLab Product GitLab EE Default
n/a
- Version
  before 12.1.12
  Status
  affected
  Constraints
  -
- Version
  before 12.2.6
  Status
  affected
  Constraints
  -
- Version
  before 12.3.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

GitLab EE

n/a

Version	Status	Constraints
before 12.1.12	affected	-
before 12.2.6	affected	-
before 12.3.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/
x_refsource_MISCVendor Advisory
https://hackerone.com/reports/518995
x_refsource_MISCPermissions Required

Link	Providers	Tags
https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/		x_refsource_MISCVendor Advisory
https://hackerone.com/reports/518995		x_refsource_MISCPermissions Required