CVE-2019-13006: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Community and Enterprise Edition versions 9.0 through 12.0.2, identified as CVE-2019-13006. The vulnerability allowed users with access to issues, but not the repository, to view the number of related merge requests on an issue, representing an incorrect access control implementation (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 score of 4.3 (MEDIUM) and a CVSS v2.0 score of 4.0 (MEDIUM), indicating a moderate severity level. The issue stems from an incorrect access control implementation that failed to properly restrict visibility of merge request information (NVD).

The vulnerability allowed unauthorized users to gain access to information about the number of merge requests related to an issue, even when they didn't have repository access. This information disclosure could potentially reveal sensitive details about project activity and development workflows (GitLab Release).

The vulnerability was fixed in GitLab versions 12.0.3, 11.11.5, and 11.10.8. GitLab strongly recommended that all installations running affected versions be upgraded to one of these patched versions immediately (GitLab Release).

The vulnerability was responsibly reported by security researcher @xanbanx, and GitLab addressed it as part of a larger security release that included fixes for multiple vulnerabilities (GitLab Release).