Disclosure of attributes of Confidential Issues and Issue Weight in Milestones Page

HackerOne report #420566 by ngalog on 2018-10-08:

Description: Visit %Security Update in golduserngalog/dfgsgfdg and you will notice even the right panel show 0 open issues, however in the burn down chart it shows one open issue, which is a confidential issue in the project golduserngalog/dfgsgfdg

Also, if you change the tab to issue weight in burndown chart, it will show 2 open issue weight, which is exactly the weight of the confidential issue.

Lastly, when you visit the bottom part of the milestone, you will notice the number of participant is 1, and he is golduserngalog, and the number of label is 1, and the label is security

Impact

Leak the details of confidential issue in milestone page, details leaked include: Label of confidential issue Number of open confidential issue Participants of confidential issue Issue weight of confidential issue

Attachments

Warning: Attachments received through HackerOne, please exercise caution!

• Screen_Shot_2018-10-08_at_10.38.30_PM.png
• Screen_Shot_2018-10-08_at_10.38.16_PM.png