{"id":"CVE-2019-15580","aliases":["EUVD-2019-6548","GHSA-cfp2-8mw9-wg68"],"status":"published","title":"An information exposure vulnerability exists in gitlab.com \u003cv12.3.2, \u003cv12.2.6, and \u003cv12.1.10 when...","description":"An information exposure vulnerability exists in gitlab.com \u003cv12.3.2, \u003cv12.2.6, and \u003cv12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01141,"percentile":0.66879,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-201"],"published":"2019-12-18T20:59:15Z","modified":"2026-10-30T10:30:20Z","products":[{"vendor":"gitlab","product":"gitlab"}],"references":[{"url":"https://hackerone.com/reports/667408","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15580"},{"url":"https://github.com/advisories/GHSA-cfp2-8mw9-wg68"}],"sources":{"cve":[{"id":"CVE-2019-15580","description":"An information exposure vulnerability exists in gitlab.com \u003cv12.3.2, \u003cv12.2.6, and \u003cv12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.","status":"published","published":"2019-12-18T20:59:15Z","modified":"2024-08-05T00:49:13.79Z","cwes":["CWE-201"],"updated_at":"2026-11-02T14:20:21.397307Z"}],"euvd":[{"id":"EUVD-2019-6548","description":"An information exposure vulnerability exists in gitlab.com \u003cv12.3.2, \u003cv12.2.6, and \u003cv12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.","status":"published","published":"2019-12-18T20:59:15Z","modified":"2024-08-05T00:49:13Z","updated_at":"2026-11-03T02:40:35.584574Z"}],"ghsa":[{"id":"GHSA-cfp2-8mw9-wg68","title":"An information exposure vulnerability exists in gitlab.com \u003cv12.3.2, \u003cv12.2.6, and \u003cv12.1.10 when...","description":"An information exposure vulnerability exists in gitlab.com \u003cv12.3.2, \u003cv12.2.6, and \u003cv12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.","status":"published","published":"2022-05-24T17:03:59Z","modified":"2024-04-04T02:44:06Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-201"],"updated_at":"2026-11-02T14:56:11.559223Z"}],"nvd":[{"id":"CVE-2019-15580","description":"An information exposure vulnerability exists in gitlab.com \u003cv12.3.2, \u003cv12.2.6, and \u003cv12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.","status":"published","published":"2019-12-18T21:15:11.977Z","modified":"2026-06-17T02:20:40.98Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-201","CWE-200"],"updated_at":"2026-11-02T14:05:40.856496Z"}],"osv":[{"id":"CVE-2019-15580","description":"An information exposure vulnerability exists in gitlab.com \u003cv12.3.2, \u003cv12.2.6, and \u003cv12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.","status":"published","published":"2019-12-18T21:15:11.977Z","modified":"2026-10-30T10:30:20.840745641Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"}]}}