CVE-2019-15592: 
GitLab vulnerability analysis and mitigation

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. The vulnerability was discovered and reported by ashish_r_padelkar, and was assigned the identifier CVE-2019-15592. The issue was addressed in GitLab's security release on August 29, 2019 (GitLab Release).

The vulnerability affects all versions of GitLab prior to version 12.2.3. The security flaw exists in the activity timeline feature where insufficient access controls allowed unauthorized visibility of merge request IDs. The issue was fixed in GitLab versions 12.2.3, 12.1.8, and 12.0.8 for both Community Edition (CE) and Enterprise Edition (EE) (GitLab Release).

The vulnerability could lead to information disclosure where guest users could access merge request IDs that should be restricted in private projects. This could potentially reveal sensitive project information to unauthorized users (GitLab Release).

GitLab strongly recommends that all installations running affected versions be upgraded to version 12.2.3 or later immediately. The fix was also backported to versions 12.1.8 and 12.0.8 for those unable to upgrade to the latest release (GitLab Release).