build1 publisher
A file.path parameter in GitLab's commit API reads server files before authentication
The fix ships in 19.3.2, 19.2.6 and 19.1.8, and scanning for the flaw started the day after disclosure. Whether you can tell if a read succeeded on your instance depends on whether your proxy logs request bodies.
Publishers:dev.to
Reality
- Evidence60
- Adoption35
- Hype gap−10
- Incentives40
- Confidence58