CVE-2019-15581: Medium severity gitlab vulnerability
Published Jan 28, 2020
·Updated
An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules.
Affected Software
6 affected components
GitLab GitLab>=12.1.0<12.1.12
GitLab GitLab>=12.1.0<12.1.12
GitLab GitLab>=12.2.0<12.2.6
GitLab GitLab>=12.2.0<12.2.6
GitLab GitLab>=12.3.0<12.3.2
GitLab GitLab>=12.3.0<12.3.2
Event History
Jan 28, 2020
CVE Published
via MITRE·02:43 AM
Data Sourced
via MITRE·02:43 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-15581?
CVE-2019-15581 has a moderate severity rating due to its potential impact on private group visibility in GitLab.
2
How do I fix CVE-2019-15581?
To fix CVE-2019-15581, upgrade to GitLab versions 12.3.2, 12.2.6, or 12.1.12 or later.
3
What types of GitLab editions are affected by CVE-2019-15581?
Both GitLab Community Edition and Enterprise Edition are affected by CVE-2019-15581.
4
Which versions of GitLab are vulnerable to CVE-2019-15581?
Versions prior to 12.3.2, 12.2.6, and 12.1.12 of GitLab are vulnerable to CVE-2019-15581.
5
What does CVE-2019-15581 allow an attacker to do?
CVE-2019-15581 allows a project owner or maintainer to view the members of any private group via merge request approval rules.