CVE-2023-4002: Insertion of Sensitive Information Into Sent Data in GitLab
First published: Fri Aug 04 2023(Updated: )
An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's configured security policies.
Credit: cve@gitlab.com cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab GitLab | >=14.1.0<16.0.8 | |
| GitLab GitLab | >=16.1.0<16.1.3 | |
| GitLab GitLab | >=16.2.0<16.2.2 | |
| >=14.1.0<16.0.8 | ||
| >=16.1.0<16.1.3 | ||
| >=16.2.0<16.2.2 |
Remedy
Upgrade to versions 16.2.2, 16.1.3, 16.0.8 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-4002?
CVE-2023-4002 is an issue discovered in GitLab EE affecting versions 14.1 before 16.0.8, 16.1 before 16.1.3, and 16.2 before 16.2.2.
How does CVE-2023-4002 affect GitLab EE?
CVE-2023-4002 allows EE-licensed users to link any security policy project by its ID to projects or groups.
What is the severity of CVE-2023-4002?
CVE-2023-4002 has a severity rating of medium with a CVSS v3 base score of 6.5.
Which software versions are affected by CVE-2023-4002?
CVE-2023-4002 affects all versions of GitLab EE starting from 14.1 before 16.0.8, 16.1 before 16.1.3, and 16.2 before 16.2.2.
How can I fix the vulnerability in GitLab EE?
To fix the vulnerability, update GitLab EE to version 16.0.8, 16.1.3, or 16.2.2, depending on your current version.
- collector/nvd-latest
- agent/author
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/softwarecombine
- agent/description
- agent/severity
- agent/remedy
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/gitlab
- canonical/gitlab gitlab
- version/gitlab gitlab/14.1.0
- version/gitlab gitlab/16.1.0
- version/gitlab gitlab/16.2.0