HexBrain

U.S. Dept Of Defense · Report #375091

Partial PII leakage due to public set gitlab

Validstatus
mediumseverity
6upvotes
2 Dec 2019disclosed

Summary

Some snippets of sensitive code was revealed along with a user's PII.

How it was found

Summary: ████████ allows you to explore the repos, snippets,etc. On the snippets we find a name+icon and some code information. This shouldn't publicly exposed as an attacker may use it to perform further attacks Description: A configuration issue allows code and the name+icon of a user on the gitlab instance to leaked publicly.

Impact

A tiny bit of PII leakage, mainly name+ personal picture. Along with a bit of code leakage

Step-by-step Reproduction Instructions

https://█████/snippets/72 https://███/explore/snippets

Product, Version, and Configuration (If applicable)

Gitlab

Suggested Mitigation/Remediation Actions

Make private

Impact

Recovery of partial code and username+picture

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original