GitLab Community Edition/Enterprise Edition up to 12.1.11/12.2.5/12.3.1 Pipeline insertion of sensitive information into sent data

Summaryinfo

A vulnerability, which was classified as problematic, has been found in GitLab Community Edition and Enterprise Edition up to 12.1.11/12.2.5/12.3.1. Affected by this vulnerability is an unknown functionality of the component Pipeline Handler. Performing a manipulation results in insertion of sensitive information into sent data. This vulnerability is reported as CVE-2019-15580. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in GitLab Community Edition and Enterprise Edition up to 12.1.11/12.2.5/12.3.1 (Bug Tracking Software). This affects an unknown functionality of the component Pipeline Handler. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. CWE is classifying the issue as CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. This is going to have an impact on confidentiality. The summary by CVE is:

An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.

The weakness was disclosed 12/18/2019. This vulnerability is uniquely identified as CVE-2019-15580. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 12.1.12, 12.2.6 or 12.3.2 eliminates this vulnerability.

The entries VDB-147479, VDB-147478, VDB-147476 and VDB-147475 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitLab

Name

• Community Edition
• Enterprise Edition

Version

• 12.1.0
• 12.1.1
• 12.1.2
• 12.1.3
• 12.1.4
• 12.1.5
• 12.1.6
• 12.1.7
• 12.1.8
• 12.1.9
• 12.1.10
• 12.1.11
• 12.2.0
• 12.2.1
• 12.2.2
• 12.2.3
• 12.2.4
• 12.2.5
• 12.3.0
• 12.3.1

License

• open-source

Website

• Vendor: https://gitlab.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion