GitLab CE/EE Information Disclosure Vulnerability in Packages API Endpoint

A vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 13.2 prior to 18.3.6, 18.4 prior to 18.4.4, and 18.5 prior to 18.5.2. This vulnerability could have allowed an authenticated attacker with reporter access to access branch names and pipeline details through the packages API endpoint, even when repository access was restricted.

Impact

Exploitation of this vulnerability could lead to unauthorized access to branch names and pipeline information, potentially allowing for further exploitation or manipulation of project resources.

Remediation

Users are advised to upgrade to GitLab versions 18.5.2, 18.4.4, or 18.3.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, see the Updating the Runner page.