CVE-2023-5612
published 2024-01-26CVE-2023-5612: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user…
PriorityP340medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
4.39%
90.1th percentile
An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 16.6.6-1 (sid) | gitlab 16.6.6-1 (sid) |
| gitlab | gitlab | < 16.6.6 | 16.6.6 |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 16.7 < 16.7.4 | 16.7.4 |
| gitlab | gitlab | >= 16.7.0 < 16.7.4 | 16.7.4 |
| gitlab | gitlab | >= 16.8 < 16.8.1 | 16.8.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2023-5612: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read t
vendor_gitlab·2024-01-26·CVSS 5.3
CVE-2023-5612 [MEDIUM] CWE-862 CVE-2023-5612: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read t
CVE-2023-5612: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
Debian
CVE-2023-5612: gitlab - An issue has been discovered in GitLab affecting all versions before 16.6.6, 16....
vendor_debian·2023·CVSS 5.3
CVE-2023-5612 [MEDIUM] CVE-2023-5612: gitlab - An issue has been discovered in GitLab affecting all versions before 16.6.6, 16....
An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
Scope: local
sid: resolved (fixed in 16.6.6-1)
GHSA
GHSA-g884-f5hg-pgw8: An issue has been discovered in GitLab affecting all versions before 16
ghsa_unreviewed·2024-01-26
CVE-2023-5612 [MEDIUM] CWE-200 GHSA-g884-f5hg-pgw8: An issue has been discovered in GitLab affecting all versions before 16
An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
OSV
CVE-2023-5612: An issue has been discovered in GitLab affecting all versions before 16
osv·2024-01-26·CVSS 5.3
CVE-2023-5612 [MEDIUM] CVE-2023-5612: An issue has been discovered in GitLab affecting all versions before 16
An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
No detection rules found.
No writeups or analysis indexed.
https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/https://gitlab.com/gitlab-org/gitlab/-/issues/428441https://hackerone.com/reports/2208790https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/https://gitlab.com/gitlab-org/gitlab/-/issues/428441https://hackerone.com/reports/2208790
2024-01-26
Published