CVE-2019-15580: Infoleak

Q: What is the severity of CVE-2019-15580?

The severity of CVE-2019-15580 is categorized as medium.

Q: How do I fix CVE-2019-15580?

To fix CVE-2019-15580, you should upgrade GitLab to version 12.3.3 or later.

Q: What versions are affected by CVE-2019-15580?

CVE-2019-15580 affects GitLab versions 12.1.10 and earlier, 12.2.6 and earlier, and 12.3.2 and earlier.

Q: What type of information is exposed in CVE-2019-15580?

CVE-2019-15580 exposes head pipeline data of public projects to unauthenticated users.

Q: Can CVE-2019-15580 be exploited without authentication?

Yes, CVE-2019-15580 can be exploited by unauthenticated users.

Published Dec 18, 2019

Updated

An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.

Affected Software

6 affected components

GitLab GitLab<12.1.10

GitLab GitLab>=12.2.0<12.2.6

GitLab GitLab>=12.3.0<12.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gitlab.com to a version that resolves this vulnerability.
Fixed in 12.3.2
Upgrade
Upgrade gitlab.com to a version that resolves this vulnerability.
Fixed in 12.2.6
Upgrade
Upgrade gitlab.com to a version that resolves this vulnerability.
Fixed in 12.1.10

Event History

Dec 18, 2019

CVE Published

via MITRE·08:59 PM

Data Sourced

via MITRE·08:59 PM

DescriptionWeakness

Data Sourced

via OSV·09:15 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2019-15580?

The severity of CVE-2019-15580 is categorized as medium.

How do I fix CVE-2019-15580?