An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing.
{
"versions": [
{
"introduced": "0"
},
{
"fixed": "12.1.12"
},
{
"introduced": "0"
},
{
"fixed": "12.1.12"
},
{
"introduced": "12.2.0"
},
{
"fixed": "12.2.6"
},
{
"introduced": "12.2.0"
},
{
"fixed": "12.2.6"
},
{
"introduced": "12.3.0"
},
{
"fixed": "12.3.2"
},
{
"introduced": "12.3.0"
},
{
"fixed": "12.3.2"
}
]
}