CVE-2020-13346
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access conf...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.
影響パッケージ
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"11.2.0"},{"fixed":"13.2.10"},{"introduced":"13.3.0"},{"fixed":"13.3.7"},{"introduced":"13.4.0"},{"fixed":"13.4.2"}]}]
参照URL
- advisory gitlab.com
- advisory hackerone.com
- web gitlab.com
- web nvd.nist.gov