Information disclosure in Gitlab Community Edition - CVE-2019-15591
Published: December 18, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30517
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-15591
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to gain access to sensitive information.
An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.
Affected software
Gitlab Community Edition
How to mitigate CVE-2019-15591
Install update from vendor's website.
Gitlab Community Edition - update to 12.3.3