CVE-2019-15594: 
GitLab vulnerability analysis and mitigation

GitLab Enterprise Edition (EE) version 11.8 and later contains a security vulnerability (CVE-2019-15594) that allows unauthorized users to obtain details of restricted pipelines through the merge request endpoint. The vulnerability was discovered and responsibly reported by @ashish_r_padelkar (GitLab Advisory, NVD).

The vulnerability has a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access and low privileges to exploit, requires no user interaction, and can result in low-level information disclosure (NVD).

When exploited, the vulnerability allows unauthorized users to view details of restricted pipelines through the merge request endpoint, potentially exposing sensitive information about the CI/CD processes (GitLab Advisory).

GitLab strongly recommends that all installations running affected versions (GitLab EE 11.8 and later) be upgraded to the latest version immediately. The issue has been fixed in GitLab security releases 12.1.2, 12.0.4, and 11.11.7 (GitLab Advisory).