PT-2019-14359 · Gitlab · Gitlab Ce/Ee+1

Ethan Strike · Published 2019-09-16 · Updated 2019-09-17 · CVE-2019-15738

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1

Description An issue was discovered where merge request IDs were being disclosed via email under certain conditions.

Recommendations For GitLab Community and Enterprise Edition versions 12.0 through 12.2.1, update to a version that contains a fix for this issue to prevent merge request IDs from being disclosed via email.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-15738

Affected Products

Gitlab

Gitlab Ce/Ee

References · 6

• https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15738 · Security Note
• https://gitlab.com/gitlab-org/gitlab-ce/issues/63124 · Note
• https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15738 · Note