PT-2020-9718 · Gitlab · Gitlab Ce/Ee+1

Published 2020-01-28 · Updated 2020-01-29 · CVE-2019-15583

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 12.3.2 GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 12.2.6 GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 12.1.12

Description An information disclosure issue exists. When an issue is moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.

Recommendations For versions prior to 12.3.2, update to version 12.3.2 or later. For versions prior to 12.2.6, update to version 12.2.6 or later. For versions prior to 12.1.12, update to version 12.1.12 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-15583

Affected Products

Gitlab

Gitlab Ce/Ee

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-15583 · Security Note
• https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15583 · Vendor Advisory
• https://hackerone.com/reports/643854 · Note