OpenProject (< 17.3.3)

A remote, authenticated attacker can exploit a vulnerability in OpenProject to disclose sensitive information.