Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2019-15732: GitLab import function can expose hidden projects
CVE-2019-15732 · published 7 years ago
Summary
GitLab versions 12.2 to 12.2.1 allow someone to use the project import feature to see projects that are meant to be private. This could let unauthorized users view confidential code or data. Update GitLab to a newer version or apply the provided patch to stop the bypass.
What to do
- Update gitlab gitlab to version 12.2.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab |
>= 12.2.0, < 12.2.3 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions.
An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions.
References
- https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-relea... Release Notes Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/57015 Broken Link
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Sep 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-15732 · NVD
Track software like this
Free during beta