CVE-2017-0920

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeReque...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

参照URL

advisory about.gitlab.com
advisory debian.org
report hackerone.com