GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.
CPE | Name | Operator | Version |
---|---|---|---|
gitlab | eq | 10.3.1-ee | |
gitlab | eq | 10.3.0-ee | |
gitlab | eq | 8.12.0-rc2-ee | |
gitlab | eq | 8.11.0-rc6-ee | |
gitlab | eq | 10.1.2 | |
gitlab | eq | 9.6.0.pre | |
gitlab | eq | 10.1.3-ee | |
gitlab | eq | 10.3.0-rc3-ee | |
gitlab | eq | 10.2.0-rc3-ee | |
gitlab | eq | 10.1.0-ee |