CVE-2023-3102 — Sensitive Info Insertion into Sent Data in Gitlab

CWE-201 — Sensitive Info Insertion into Sent DataCWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.5%
top 35.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedJul 21

Description

A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶CVEListV5gitlab/gitlab16.0 — 16.0.6+1
▶NVDgitlab/gitlab16.0.0 — 16.0.6+1
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-5h2f-9v3w-h48r: A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16↗2023-07-21
▶

📋Vendor Advisories

2
GitLab
CVE-2023-3102: A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting fro↗2023-07-21
▶
Debian
CVE-2023-3102: gitlab - A sensitive information leak issue has been discovered in GitLab EE affecting al...↗2023
▶