IDOR Vulnerability in GitLab Community and Enterprise Editions
CVE-2019-15581

5.3MEDIUM

Key Information:

Vendor
Gitlab
Status
Gitlab Ee
Vendor
CVE Published:
28 January 2020

Summary

An Insecure Direct Object Reference (IDOR) vulnerability exists in GitLab Community Edition and Enterprise Edition versions below 12.3.2, allowing project owners or maintainers to view the members of any private group via merge request approval rules. This flaw potentially exposes sensitive information and could lead to unauthorized data access within GitLab projects.

Affected Version(s)

GitLab EE before 12.3.2

GitLab EE before 12.2.6

GitLab EE before 12.1.12

References

https://about.gitlab.com/blog/2019/09/30/security-release...
x_refsource_MISC
https://hackerone.com/reports/518995
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.