CVE-2019-15583

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
GitLab	GitLab CE/EE	before 12.3.2; before 12.2.6; before 12.1.12

References

https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/Vendor Advisory
https://hackerone.com/reports/643854Permissions Required
https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/Vendor Advisory
https://hackerone.com/reports/643854Permissions Required

Timeline

Published: Jan 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155846.5A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields CVE-2019-155859.8Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the Git CVE-2019-155866.1A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.CVE-2019-155875.4In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.CVE-2019-155887.2There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Ex CVE-2019-155898.8An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to us CVE-2019-15595.9If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive on CVE-2019-155907.5An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where priv CVE-2019-155916.5An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning report CVE-2019-155924.3GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associat CVE-2019-155936.5GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service att CVE-2019-155944.3GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request e