CVE-2021-39903

In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"14.2.6"},{"introduced":"14.3.0"},{"fixed":"14.3.4"},{"introduced":"14.4.0"},{"fixed":"14.4.1"}]}]

Références

advisory gitlab.com
advisory hackerone.com
web gitlab.com
web nvd.nist.gov