CVE-2023-0838: Infoleak
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0838?
CVE-2023-0838 is rated as a medium severity vulnerability in GitLab.
How do I fix CVE-2023-0838?
To fix CVE-2023-0838, upgrade to GitLab versions 15.8.5, 15.9.4, or 15.10.1 or later.
What versions of GitLab are affected by CVE-2023-0838?
CVE-2023-0838 affects GitLab versions starting from 15.1 and before 15.8.5, 15.9 and before 15.9.4, and 15.10 and before 15.10.1.
What type of issue is CVE-2023-0838 related to?
CVE-2023-0838 involves a vulnerability that allows a maintainer to modify a webhook URL, potentially leaking masked webhook secrets.
Is there a connection between CVE-2023-0838 and CVE-2022-4342?
Yes, CVE-2023-0838 addresses an incomplete fix for the previously reported CVE-2022-4342.