CVE-2019-12434
published 2020-03-10CVE-2019-12434: An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast…
PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.75%
50.5th percentile
An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 12.6.8-3 (sid) | gitlab 12.6.8-3 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | 10.6.0 – 11.11.0 | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2019-12434: An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the
vendor_gitlab·2020-03-10·CVSS 4.3
CVE-2019-12434 [MEDIUM] CWE-330 CVE-2019-12434: An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the
CVE-2019-12434: An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure.
Debian
CVE-2019-12434: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 10.6 through ...
vendor_debian·2019·CVSS 4.3
CVE-2019-12434 [MEDIUM] CVE-2019-12434: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 10.6 through ...
An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure.
Scope: local
sid: resolved (fixed in 12.6.8-3)
GHSA
GHSA-75fp-hxc3-f56v: An issue was discovered in GitLab Community and Enterprise Edition 10
ghsa_unreviewed·2022-05-24
CVE-2019-12434 [MEDIUM] GHSA-75fp-hxc3-f56v: An issue was discovered in GitLab Community and Enterprise Edition 10
An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-03-10
Published