CVE-2019-13002: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Community and Enterprise Edition versions 11.10 through 12.0.2, where unauthorized users were able to read pipeline information of the last merge request. This vulnerability was assigned CVE-2019-13002 and was disclosed on July 3, 2019 (GitLab Release, NVD).

The vulnerability is classified as an Incorrect Access Control issue. According to the CVSS 3.1 scoring system, it received a base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and low privileges required (NVD).

The vulnerability allowed unauthorized users to access pipeline information from the last merge request, potentially exposing sensitive project information to users who should not have access to it (GitLab Release).

The vulnerability was patched in GitLab versions 12.0.3, 11.11.5, and 11.10.8. Users running affected versions were strongly recommended to upgrade immediately to one of these patched versions (GitLab Release).

The vulnerability was responsibly reported by security researcher @xanbanx, who was acknowledged in GitLab's security release announcement (GitLab Release).