CVE-2023-1098 — Exposure of Information Through Shell Error Message in Gitlab

CWE-535 — Exposure of Information Through Shell Error Message5 documents5 sources
Severity
4.9MEDIUMNVD
EPSS
0.4%
top 36.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedApr 5

Description

An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages5 packages

▶NVDgitlab/gitlab11.5.0 — 15.8.5+2
▶debiandebian/gitlab< gitlab 15.10.8+ds1-2 (sid)
▶CVEListV5gitlab/gitlab>=11.5, <15.8.5, >=15.10, <15.10.1, >=15.9, <15.9.4+2
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-34fg-2j3p-288g: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11↗2023-04-05
▶
OSV
CVE-2023-1098: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11↗2023-04-05
▶

📋Vendor Advisories

2
GitLab
CVE-2023-1098: An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions star↗2023-04-05
▶
Debian
CVE-2023-1098: gitlab - An information disclosure vulnerability has been discovered in GitLab EE/CE affe...↗2023
▶