CVE-2017-0920

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeReque...

Original description

The description as published by the source.

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory about.gitlab.com
advisory debian.org
report hackerone.com