CVE-2023-1210: Generation of Error Message Containing Sensitive Information in GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membership by email domain.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1210?
The severity of CVE-2023-1210 is medium (4.3).
Which versions of GitLab are affected by CVE-2023-1210?
All versions starting from 12.9 to 16.0.8, starting from 16.1 to 16.1.3, and starting from 16.2 to 16.2.2 are affected by CVE-2023-1210.
How can a user's email be leaked in CVE-2023-1210?
A user's email can be leaked via an error message for groups that restrict membership by email domain.
Where can I find more information about CVE-2023-1210?
You can find more information about CVE-2023-1210 in the following references: [HackerOne report](https://hackerone.com/reports/1884672) and [GitLab issue](https://gitlab.com/gitlab-org/gitlab/-/issues/394775).
What is the CWE of CVE-2023-1210?
The CWE of CVE-2023-1210 is NVD-CWE-noinfo (200).