CVE-2019-13011: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Enterprise Edition versions 8.11.0 through 12.0.2, identified as CVE-2019-13011. The vulnerability allowed users with project access, but without repository access, to enumerate merge request template names through brute-force methods (GitLab Advisory).

The vulnerability is characterized by excessive algorithmic complexity, classified under CWE-400 (Uncontrolled Resource Consumption). It received a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and required low privileges (NVD).

The vulnerability allowed unauthorized users to create a list of merge request template names through brute-force methods, potentially exposing sensitive project information. The impact was limited to information disclosure of template names, with no direct system compromise capabilities (GitLab Advisory).

The vulnerability was patched in GitLab version 12.0.3. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately. The fix was credited to @ashish_r_padelkar who responsibly reported this vulnerability (GitLab Advisory).