Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Insertion of Sensitive Information Into Sent Data in GitLab (GitLab GitLab)

CVE-2023-4002
MEDIUM 5.3

En bref

Source
NVD
EPSS
EPSS 0.59 % · centile 48 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
GitLab
Statut NVD
Modified

Rechercher sur…

Description

An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's configured security policies.

Faiblesses (CWE)

  • CWE-201 — Insertion of Sensitive Information Into Sent Data

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NGitLab
CVSS 3.1MEDIUM 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NNVD · cve@gitlab.com (Secondary)
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
GitLab · GitLabaffected 14.1 < 16.0.8 ; affected 16.1.0 < 16.1.3 ; affected 16.2.0 < 16.2.2

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD