CVE-2019-15592: Infoleak
Published Feb 14, 2020
·Updated
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
Affected Software
7 affected components
GitLab GitLab>=11.2.0<12.0.8
GitLab GitLab>=11.2.0<12.0.8
GitLab GitLab>=12.1.0<12.1.8
GitLab GitLab>=12.1.0<12.1.8
GitLab GitLab>=12.2.0<12.2.3
GitLab GitLab>=12.2.0<12.2.3
GitLab GitLab
Event History
Feb 14, 2020
CVE Published
via MITRE·09:27 PM
Data Sourced
via MITRE·09:27 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-15592?
CVE-2019-15592 is classified as a medium severity vulnerability that allows unauthorized information disclosure.
2
How do I fix CVE-2019-15592?
To fix CVE-2019-15592, you should upgrade your GitLab instance to version 12.2.3 or above.
3
Who is affected by CVE-2019-15592?
CVE-2019-15592 affects all GitLab versions up to and including 12.2.2 for both community and enterprise editions.
4
What type of vulnerability is CVE-2019-15592?
CVE-2019-15592 is an information disclosure vulnerability that allows guest users to see sensitive merge request IDs.
5
Can guest users in private projects access merge request IDs due to CVE-2019-15592?
Yes, guest users in private projects can access merge request IDs due to the vulnerability in CVE-2019-15592.