CVE-2023-3993 — Log File Information Exposure in Gitlab

CWE-532 — Log File Information ExposureCWE-200 — Sensitive Information Exposure5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 74.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedAug 2

Description

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDgitlab/gitlab14.3 — 16.0.8+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-cjf2-62xp-p6mj: An issue has been discovered in GitLab EE affecting all versions starting from 14↗2023-08-02
▶

📋Vendor Advisories

3
GitLab
CVE-2023-3993: An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all↗2023-08-02
▶
Red Hat
gitlab: access tokens may have been logged on specific queries↗2023-08-02
▶
Debian
CVE-2023-3993: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1...↗2023
▶