An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.
{
"versions": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.12"
},
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.12"
},
{
"introduced": "12.2.0"
},
{
"fixed": "12.2.6"
},
{
"introduced": "12.2.0"
},
{
"fixed": "12.2.6"
},
{
"introduced": "12.3.0"
},
{
"fixed": "12.3.2"
},
{
"introduced": "12.3.0"
},
{
"fixed": "12.3.2"
}
]
}