CVE-2023-2620: Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-2620?
CVE-2023-2620 is an issue discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions.
What is the severity of CVE-2023-2620?
The severity of CVE-2023-2620 is medium with a severity value of 3.8.
How does CVE-2023-2620 impact GitLab CE/EE?
CVE-2023-2620 allows a maintainer to modify a webhook URL to leak masked webhook secrets.
Which software versions of GitLab CE/EE are affected by CVE-2023-2620?
The affected software versions of GitLab CE/EE are all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, and all versions from 16.1 prior to 16.1.1.
How can the vulnerability in GitLab CE/EE be fixed?
To fix the vulnerability in GitLab CE/EE, it is recommended to update to versions 15.11.10, 16.0.6, or 16.1.1 or later.