CVE-2018-17449

2023-04-1500:00:00

ubuntu.com

cve-2018-17449

gitlab

sensitive information

security issue

events api

direct object reference

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

54.3%

JSON

An issue was discovered in GitLab Community and Enterprise Edition before
11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers
could obtain sensitive information about issues, comments, and project
titles via events API insecure direct object reference.