CVE-2019-15578
published 2020-01-28CVE-2019-15578: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.02%
59.1th percentile
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 12.6.8-3 (sid) | gitlab 12.6.8-3 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 12.1.0 < 12.1.12 | 12.1.12 |
| gitlab | gitlab | >= 12.2.0 < 12.2.6 | 12.2.6 |
| gitlab | gitlab | >= 12.3.0 < 12.3.2 | 12.3.2 |
| gitlab | gitlab_ce_ee | — | — |
| gitlab | gitlab_ce_ee | — | — |
| gitlab | gitlab_ce_ee | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2019-15578: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a pri
vendor_gitlab·2020-01-28·CVSS 5.3
CVE-2019-15578 [MEDIUM] CWE-200 CVE-2019-15578: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a pri
CVE-2019-15578: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.
Debian
CVE-2019-15578: gitlab - An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab...
vendor_debian·2019·CVSS 5.3
CVE-2019-15578 [MEDIUM] CVE-2019-15578: gitlab - An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab...
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.
Scope: local
sid: resolved (fixed in 12.6.8-3)
GHSA
GHSA-m5gx-r8rq-3635: An information disclosure exists in < 12
ghsa_unreviewed·2022-05-24
CVE-2019-15578 [MEDIUM] GHSA-m5gx-r8rq-3635: An information disclosure exists in < 12
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.
OSV
CVE-2019-15578: An information disclosure exists in < 12
osv·2020-01-28·CVSS 5.3
CVE-2019-15578 [MEDIUM] CVE-2019-15578: An information disclosure exists in < 12
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-01-28
Published