CVE-2023-3102: Insertion of Sensitive Information Into Sent Data in GitLab
A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.1
Event History
Frequently Asked Questions
What is CVE-2023-3102?
CVE-2023-3102 is a vulnerability in GitLab EE that allows access to titles of private issues and MR (Merge Requests).
What is the severity of CVE-2023-3102?
The severity of CVE-2023-3102 is medium, with a CVSS score of 5.3.
Which versions of GitLab EE are affected by CVE-2023-3102?
All versions starting from 16.0 before 16.0.6 and all versions starting from 16.1 before 16.1.1 of GitLab EE are affected by CVE-2023-3102.
How can the sensitive information leak issue be mitigated in GitLab EE?
To mitigate the sensitive information leak issue in GitLab EE, it is recommended to update to version 16.0.6 or higher for versions starting from 16.0 before 16.0.6, and to version 16.1.1 or higher for versions starting from 16.1 before 16.1.1.
Where can I find more information about CVE-2023-3102?
More information about CVE-2023-3102 can be found at the following references: [HackerOne report](https://hackerone.com/reports/2012073) and [GitLab issue](https://gitlab.com/gitlab-org/gitlab/-/issues/414269).