CVE-2019-15592 - GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline

Back Back to CVE browser

MEDIUM

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline

Published Feb 14, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 1.03%

Description

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.

Affected products

Vendor n/a Product GitLab Default
n/a
- Version
  12.2.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

GitLab

n/a

Version	Status	Constraints
12.2.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
x_refsource_MISCVendor Advisory
https://hackerone.com/reports/588876
x_refsource_MISCPermissions Required

Link	Providers	Tags
https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/		x_refsource_MISCVendor Advisory
https://hackerone.com/reports/588876		x_refsource_MISCPermissions Required