PT-2019-14347 · Gitlab · Gitlab Ce/Ee+1

Ashish + 1 · Published 2019-09-16 · Updated 2020-08-24 · CVE-2019-15725

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1

Description An issue was discovered that could result in disclosure of private milestones, labels, and other information due to an IDOR in the epic notes API.

Recommendations For GitLab Community and Enterprise Edition versions 12.0 through 12.2.1, consider restricting access to the epic notes API until a fix is available. As a temporary workaround, avoid using the epic notes API to minimize the risk of information disclosure.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2019-15725

Affected Products

Gitlab

Gitlab Ce/Ee

References · 6

• https://osv.dev/vulnerability/CVE-2019-15725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15725 · Security Note
• https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15725 · Note
• https://gitlab.com/gitlab-org/gitlab-ee/issues/11431 · Note
• https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released · Note