CVE-2019-15583 - An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE)

Back Back to CVE browser

HIGH

An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE)

Published Jan 28, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.38%

Description

An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.

Affected products

Vendor GitLab Product GitLab CE/EE Default
n/a
- Version
  before 12.1.12
  Status
  affected
  Constraints
  -
- Version
  before 12.2.6
  Status
  affected
  Constraints
  -
- Version
  before 12.3.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

GitLab CE/EE

n/a

Version	Status	Constraints
before 12.1.12	affected	-
before 12.2.6	affected	-
before 12.3.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/
x_refsource_MISCVendor Advisory
https://hackerone.com/reports/643854
x_refsource_MISCPermissions Required

Link	Providers	Tags
https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/		x_refsource_MISCVendor Advisory
https://hackerone.com/reports/643854		x_refsource_MISCPermissions Required