CVE-2019-15580: Infoleak
Published Dec 18, 2019
·Updated
An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.
Affected Software
6 affected components
GitLab GitLab<12.1.10
GitLab GitLab<12.1.10
GitLab GitLab>=12.2.0<12.2.6
GitLab GitLab>=12.2.0<12.2.6
GitLab GitLab>=12.3.0<12.3.2
GitLab GitLab>=12.3.0<12.3.2
Event History
Dec 18, 2019
CVE Published
via MITRE·08:59 PM
Data Sourced
via MITRE·08:59 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-15580?
The severity of CVE-2019-15580 is categorized as medium.
2
How do I fix CVE-2019-15580?
To fix CVE-2019-15580, you should upgrade GitLab to version 12.3.3 or later.
3
What versions are affected by CVE-2019-15580?
CVE-2019-15580 affects GitLab versions 12.1.10 and earlier, 12.2.6 and earlier, and 12.3.2 and earlier.
4
What type of information is exposed in CVE-2019-15580?
CVE-2019-15580 exposes head pipeline data of public projects to unauthenticated users.
5
Can CVE-2019-15580 be exploited without authentication?
Yes, CVE-2019-15580 can be exploited by unauthenticated users.