NetSight
IP …
medium4.3

CVE-2021-39889

In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to …

Impact

In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch.

Affected products

VendorProductAffected versions
GitlabGitlab
from 14.1.0 before 14.1.7
from 14.2.0 before 14.2.5
from 14.3.0 before 14.3.1

Weakness classification

CWE-639

References