CVE-2023-1401: Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1401?
The severity of CVE-2023-1401 is medium, with a severity value of 4.3.
What versions of GitLab are affected by CVE-2023-1401?
All versions of GitLab starting from 3.0.29 before 4.0.5 are affected by CVE-2023-1401.
What is the issue in CVE-2023-1401?
The issue in CVE-2023-1401 is that the GitLab DAST scanner leaks cross-site cookies on redirect during authorization.
Where can I find more information about CVE-2023-1401?
You can find more information about CVE-2023-1401 at the following references: [HackerOne report](https://hackerone.com/reports/1889255) and [GitLab issue](https://gitlab.com/gitlab-org/gitlab/-/issues/396533).
How do I fix the vulnerability in CVE-2023-1401?
To fix the vulnerability in CVE-2023-1401, update GitLab to version 4.0.5 or newer.