MEDIUM

CVE-2019-15740

Gitlab GitLab 2019-09-16 CVSS v3.1

CVSS

5.3

Description

An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads.

Summary dbcve.org

GitLab versions 7.9 through 12.2.1 failed to strip EXIF geolocation metadata from uploaded images, causing sensitive location data embedded in image files to be stored and potentially exposed to other users.

Mitigation

Upgrade GitLab to version 12.2.2 or later, which includes the fix to remove EXIF geolocation data from uploads.

Weakness (CWE)

CWE-200 Information Exposure

EPSS Score

1.61%

Probability of exploitation in next 30 days

74.8th percentile

References

https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab-ce/issues/61390 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE