CVE-2019-15736

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/51401Broken Link
https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/51401Broken Link

Timeline

Published: Sep 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-157376.5An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication an CVE-2019-157385.3An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were bei CVE-2019-157396.1An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly s CVE-2019-15745.4Cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition Migration tool 1.1.12 and earlier may allow an authenticated attac CVE-2019-157405.3An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from cert CVE-2019-157419.8An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation CVE-2019-157427.8A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application. A local attacker c CVE-2019-157435.5The Sony Xperia Touch Android device with a build fingerprint of Sony/blanc_windy/blanc_windy:7.0/LOIRE-SMART-BLANC-1.0.0-170530-0834/1:user CVE-2019-157443.3The Sony Xperia Xperia XZs Android device with a build fingerprint of Sony/keyaki_softbank/keyaki_softbank:7.1.1/TONE3-3.0.0-SOFTBANK-170517 CVE-2019-157458.8The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the CVE-2019-157469.8SITOS six Build v6.2.1 allows an attacker to inject arbitrary PHP commands. As a result, an attacker can compromise the running server and e CVE-2019-157478.8SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role