CVE-2023-4002: Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's configured security policies.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.2.2 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.1.3 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.0.8
Event History
Frequently Asked Questions
What is CVE-2023-4002?
CVE-2023-4002 is an issue discovered in GitLab EE affecting versions 14.1 before 16.0.8, 16.1 before 16.1.3, and 16.2 before 16.2.2.
How does CVE-2023-4002 affect GitLab EE?
CVE-2023-4002 allows EE-licensed users to link any security policy project by its ID to projects or groups.
What is the severity of CVE-2023-4002?
CVE-2023-4002 has a severity rating of medium with a CVSS v3 base score of 6.5.
Which software versions are affected by CVE-2023-4002?
CVE-2023-4002 affects all versions of GitLab EE starting from 14.1 before 16.0.8, 16.1 before 16.1.3, and 16.2 before 16.2.2.
How can I fix the vulnerability in GitLab EE?
To fix the vulnerability, update GitLab EE to version 16.0.8, 16.1.3, or 16.2.2, depending on your current version.