CVE-2023-3413 — Sensitive Info Insertion into Sent Data in Gitlab

CWE-201 — Sensitive Info Insertion into Sent DataCWE-200 — Sensitive Information ExposureCWE-378 — Creation of Temporary File With Insecure Permissions9 documents8 sources
Severity
7.5HIGHNVD
GHSA5.5
EPSS
0.2%
top 55.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabLinux KernelDebian Gitlab
Timeline
PublishedSep 29
Latest updateDec 24

Description

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to read the source code of a project through a fork created before changing visibility to only project members.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab16.3 — 16.3.5+1
▶NVDgitlab/gitlab16.2 — 16.2.8+2
▶debiandebian/gitlab< gitlab 16.4.4+ds2-2 (sid)
▶gitlabgitlab/gitlab
▶Linuxlinux/linux_kernel5.15.0 — 5.15.111+3

🔴Vulnerability Details

4
OSV
fs/ntfs3: Fix OOB read in indx_insert_into_buffer↗2025-12-24
▶
GHSA
Insecure Temporary File in RESTEasy↗2025-01-15
▶
OSV
CVE-2023-3413: An issue has been discovered in GitLab affecting all versions starting from 16↗2023-09-29
▶
GHSA
GHSA-v9r7-fcc3-gg2v: An issue has been discovered in GitLab affecting all versions starting from 16↗2023-09-29
▶

📋Vendor Advisories

3
Red Hat
kernel: fs/ntfs3: Fix OOB read in indx_insert_into_buffer↗2025-12-24
▶
GitLab
CVE-2023-3413: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all ver↗2023-09-29
▶
Debian
CVE-2023-3413: gitlab - An issue has been discovered in GitLab affecting all versions starting from 16.2...↗2023
▶