CVE-2023-0989: Improper Ownership Management in GitLab
An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-0989?
CVE-2023-0989 is an information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1.
How does CVE-2023-0989 affect GitLab?
CVE-2023-0989 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration in GitLab CE/EE.
What is the severity of CVE-2023-0989?
The severity of CVE-2023-0989 is medium with a severity value of 5.7.
How can I fix CVE-2023-0989?
To fix CVE-2023-0989, update GitLab CE/EE to version 16.2.8, 16.3.5, or 16.4.1 or later.
Where can I find more information about CVE-2023-0989?
You can find more information about CVE-2023-0989 in the GitLab issue tracker: [https://gitlab.com/gitlab-org/gitlab/-/issues/417275] and in the HackerOne report: [https://hackerone.com/reports/1875515].