An issue exists in GitLab Enterprise Edition prior to 11.1.7, 11.2.x prior to 11.2.4, and 11.3.x prior to 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
gitlab gitlab |
||
gitlab gitlab 11.3.0 |
Vulmon