CVE-2023-1098
published 2023-04-05CVE-2023-1098: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from…
PriorityP424medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EPSS
0.94%
56.6th percentile
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 11.5.0 < 15.8.5 | 15.8.5 |
| gitlab | gitlab | >= 15.9.0 < 15.9.4 | 15.9.4 |
| gitlab | gitlab_ee | — | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
osv4.9MEDIUM
vendor_debian5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-34fg-2j3p-288g: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11
ghsa_unreviewed·2023-04-05
CVE-2023-1098 [MEDIUM] CWE-535 GHSA-34fg-2j3p-288g: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.
OSV
CVE-2023-1098: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11
osv·2023-04-05·CVSS 4.9
CVE-2023-1098 [MEDIUM] CVE-2023-1098: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.
GitLab
CVE-2023-1098: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions star
vendor_gitlab·2023-04-05·CVSS 5.8
CVE-2023-1098 [MEDIUM] CWE-535 CVE-2023-1098: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions star
CVE-2023-1098: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.
Debian
CVE-2023-1098: gitlab - An information disclosure vulnerability has been discovered in GitLab EE/CE affe...
vendor_debian·2023·CVSS 5.8
CVE-2023-1098 [MEDIUM] CVE-2023-1098: gitlab - An information disclosure vulnerability has been discovered in GitLab EE/CE affe...
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1098.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/383745https://hackerone.com/reports/1784294https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1098.jsonhttps://gitlab.com/gitlab-org/gitlab/-/issues/383745https://hackerone.com/reports/1784294
2023-04-05
Published