CVE-2019-11545

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved to a private project, the private project namespace is leaked to unauthorized users with access to the original issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/58939Exploit, Vendor Advisory
https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/58939Exploit, Vendor Advisory

Timeline

Published: Sep 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-115465.3An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has CVE-2019-115476.1An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has CVE-2019-115485.4An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a CVE-2019-115496.5An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x bef CVE-2019-11557.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who succ CVE-2019-115505.9Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation.CVE-2019-115515.5In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a fil CVE-2019-115527.0Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injec CVE-2019-115538.8In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organizat CVE-2019-115545.9The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a CVE-2019-115555.9The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reass CVE-2019-115566.1Pagure before 5.6 allows XSS via the templates/blame.html blame view.