Boards leak private label names and desciptions
该报告还没有中文解读。
原文摘录
摘自原文（2180 字符中的一小部分）
Vulnerability details In anticipation of today's release, I took a look at the new boards feature - which, unrelated to this report, is awesome! There turns out to be an IDOR vulnerability when creating a list based on a label. An attacker can create a list with a label ID that belongs to a private …
原文中的代码
POST /jobertabma/test/board/lists HTTP/1.1
Host: gitlab-instance
...
{"list":{"label_id":2}}默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 GitLab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @jobert · 版权归作者与 GitLab 所有