Description

By using the graphql endpoint, it was possible to get list of all the Gitlab users. Therefore, this information can be used to conduct further attacks.

Remediation

Limit information exposed to anonymous users

References

GitLab GraphQL API

Related Vulnerabilities

WordPress Plugin Gallery-Flagallery Photo Portfolio Information Disclosure (4.24)

Joomla Debug Console enabled

WordPress Plugin All-in-One WP Migration Information Disclosure (7.0)

WordPress Plugin A2 Optimized WP Information Disclosure (2.0.10.8)

PHP X Prober publicly accessible

Severity

Low

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure Configuration CWE-200