CVE-2019-12434: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Community and Enterprise Edition versions 10.6 through 11.11 where users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. This vulnerability was assigned CVE-2019-12434 and was disclosed on June 3, 2019 (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-330 (Use of Insufficiently Random Values) and affects both Community and Enterprise editions of GitLab (NVD).

The vulnerability allows information disclosure by enabling attackers to discover private project URLs through the analysis of issue links in comments. This could potentially expose the existence and names of private projects that should remain confidential (GitLab Release).

GitLab has addressed this vulnerability in versions 11.11.1, 11.10.5, and 11.9.12. It is strongly recommended that all installations running affected versions be upgraded to the latest version immediately (GitLab Release).

The vulnerability was responsibly reported by security researcher @ashish_r_padelkar, who was acknowledged by GitLab for their contribution to security (GitLab Release).