CVE-2023-2620: Insertion of Sensitive Information Into Sent Data in GitLab
First published: Thu Jul 13 2023(Updated: )
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838.
Credit: cve@gitlab.com cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab GitLab | >=15.1.0<15.11.10 | |
| GitLab GitLab | >=15.1.0<15.11.10 | |
| GitLab GitLab | >=16.0.0<16.0.6 | |
| GitLab GitLab | >=16.0.0<16.0.6 | |
| GitLab GitLab | >=16.1.0<16.1.1 | |
| GitLab GitLab | >=16.1.0<16.1.1 |
Remedy
Upgrade to versions 15.11.10, 16.0.6, 16.1.1 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-2620?
CVE-2023-2620 is an issue discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions.
What is the severity of CVE-2023-2620?
The severity of CVE-2023-2620 is medium with a severity value of 3.8.
How does CVE-2023-2620 impact GitLab CE/EE?
CVE-2023-2620 allows a maintainer to modify a webhook URL to leak masked webhook secrets.
Which software versions of GitLab CE/EE are affected by CVE-2023-2620?
The affected software versions of GitLab CE/EE are all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, and all versions from 16.1 prior to 16.1.1.
How can the vulnerability in GitLab CE/EE be fixed?
To fix the vulnerability in GitLab CE/EE, it is recommended to update to versions 15.11.10, 16.0.6, or 16.1.1 or later.
- collector/nvd-latest
- agent/references
- agent/author
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/description
- agent/severity
- agent/remedy
- agent/first-publish-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/title
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/gitlab
- canonical/gitlab gitlab
- version/gitlab gitlab/15.1.0
- version/gitlab gitlab/16.0.0
- version/gitlab gitlab/16.1.0