Описание
An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API.
Ссылки
- Broken Link
- Permissions Required
Уязвимые конфигурации
Конфигурация 1Версия до 18.1.5 (исключая)Версия до 18.1.5 (исключая)Версия от 18.2.0 (включая) до 18.2.5 (исключая)Версия от 18.2.0 (включая) до 18.2.5 (исключая)
Одно из
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:18.3.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:18.3.0:*:*:*:enterprise:*:*:*
EPSS
Процентиль: 6%
0.00026
Низкий
5.8 Medium
CVSS3
5.3 Medium
CVSS3
Дефекты
CWE-862
Связанные уязвимости
CVSS3: 5.8
debian
21 день назад
An issue has been discovered in GitLab CE/EE affecting all versions be ...
CVSS3: 5.8
github
21 день назад
An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API.
EPSS
Процентиль: 6%
0.00026
Низкий
5.8 Medium
CVSS3
5.3 Medium
CVSS3
Дефекты
CWE-862