CVE-2019-13011

Name of the Vulnerable Software and Affected Versions: GitLab Enterprise Edition versions 8.11.0 through 12.0.2

Description: An issue was discovered that allows a user with access to a project, but not its repository, to create a list of merge requests template names using brute-force. The issue has excessive algorithmic complexity.

Recommendations: For GitLab Enterprise Edition versions 8.11.0 through 12.0.2, consider restricting access to merge requests template names to prevent brute-force attacks until a fix is available. As a temporary workaround, consider implementing rate limiting on API endpoints related to merge requests to minimize the risk of exploitation.