An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration.
The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 13.11 (including) | 16.2.8 (excluding) |
| Gitlab | Gitlab | 16.3.0 (including) | 16.3.5 (excluding) |
| Gitlab | Gitlab | 16.4.0 (including) | 16.4.0 (including) |
| Gitlab | Ubuntu | esm-apps/xenial | * |
| Gitlab | Ubuntu | upstream | * |