Information Disclosure

2023-07-2308:25:19

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

gitlab

vulnerability

improper authentication

access

sensitive user info

software

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

38.3%

JSON

gitlab is vulnerable to Information Disclosure. The library contains an improper authentication mechanism which allows a user with certain amount of information to authenticate without a personal access token and gain access to sensitive user information.