CVE-2021-39876
EUVD-2021-2623328.03.2022, 19:15
In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | 11.3 ≤ 𝑥 < 14.1.7 |
| gitlab | gitlab | 11.3.0 ≤ 𝑥 < 14.1.7 |
| gitlab | gitlab | 14.2 ≤ 𝑥 < 14.2.5 |
| gitlab | gitlab | 14.2 ≤ 𝑥 < 14.2.5 |
| gitlab | gitlab | 14.3.0 ≤ 𝑥 < 14.3.1 |
| gitlab | gitlab | 14.3.0 ≤ 𝑥 < 14.3.1 |
𝑥
= Vulnerable software versions
References