CVE-2019-15590: High severity gitlab vulnerability
An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15590?
CVE-2019-15590 is a medium-severity access control vulnerability affecting specific versions of GitLab.
How do I fix CVE-2019-15590?
To fix CVE-2019-15590, upgrade GitLab to version 12.3.5, 12.2.8, or 12.1.14 or later.
Who is affected by CVE-2019-15590?
CVE-2019-15590 affects users of GitLab Community and Enterprise Editions versions prior to 12.3.5, 12.2.8, and 12.1.14.
What does CVE-2019-15590 disclose?
CVE-2019-15590 allows unauthorized disclosure of private merge requests and issues through the Group Search feature.
Is CVE-2019-15590 specific to certain GitLab features?
Yes, CVE-2019-15590 specifically involves a vulnerability related to the Elasticsearch integration in GitLab.