CVE-2019-12433: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Community and Enterprise Edition versions 11.7 through 11.11, identified as CVE-2019-12433. The vulnerability involves improper input validation where restricted visibility settings allowed the creation of internal projects within private groups, leading to multiple permission issues. The vulnerability was disclosed and patched on June 3, 2019 (GitLab Release).

The vulnerability stems from an improper input validation mechanism in GitLab's project visibility settings. The issue specifically manifests when users attempt to create internal projects within private groups, which should normally be restricted. This implementation flaw bypasses intended permission controls (Debian Tracker).

The vulnerability could lead to multiple permission issues within GitLab installations, potentially exposing private group information through internal projects that should not have been allowed to exist in such contexts (GitLab Release).

GitLab addressed this vulnerability in versions 11.11.1, 11.10.5, and 11.9.12 for both Community Edition (CE) and Enterprise Edition (EE). Organizations running affected versions are strongly recommended to upgrade to these patched versions immediately (GitLab Release).