CVE-2019-15592

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	GitLab	12.2.3

References

https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/Vendor Advisory
https://hackerone.com/reports/588876Permissions Required
https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/Vendor Advisory
https://hackerone.com/reports/588876Permissions Required

Timeline

Published: Feb 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155936.5GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service att CVE-2019-155944.3GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request e CVE-2019-155958.8A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands CVE-2019-155967.5A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within t CVE-2019-155979.8A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.CVE-2019-155989.8A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the c CVE-2019-155999.8A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the CVE-2019-156007.5A Path traversal exists in http_server which allows an attacker to read arbitrary system files.CVE-2019-156026.1The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in CVE-2019-156036.1The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory CVE-2019-156047.5Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate CVE-2019-156059.8HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed