CVE-2019-5466

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	GitLab CE/EE	Affects GitLab CE/EE 11.5 and later; Fixed in 12.1.2 in 12.0.4 and in 11.11.6

References

https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/Patch, Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/59809Exploit, Vendor Advisory
https://hackerone.com/reports/507113Permissions Required
https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/Patch, Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/59809Exploit, Vendor Advisory
https://hackerone.com/reports/507113Permissions Required

Timeline

Published: Jan 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-54675.4An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. CVE-2019-54688.8An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used wi CVE-2019-54696.5An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other CVE-2019-54707.5An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could resul CVE-2019-54715.4An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS CVE-2019-54727.5An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete ep CVE-2019-54737.2An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4 CVE-2019-54746.5An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overrid CVE-2019-54758.8The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vuln CVE-2019-54769.8An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able t CVE-2019-54779.8A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` me CVE-2019-54785.5A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control