CVE-2019-5466

2020-01-2802:39:28

CWE-639

hackerone

www.cve.org

4.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.4%

JSON

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.

CNA Affected

[
  {
    "product": "GitLab CE/EE",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Affects GitLab CE/EE 11.5 and later"
      },
      {
        "status": "affected",
        "version": "Fixed in 12.1.2 in 12.0.4 and in 11.11.6"
      }
    ]
  }
]