CVE-2023-5612: Disclosure of the public email in Tags RSS Feed
An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.7.4Fixed in 16.8.1 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.6.6 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.7.4 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.8.1 - Compensating control
If you cannot upgrade immediately, treat CVE-2023-5612 (Disclosure of the public email in Tags RSS Feed) and Missing Authorization as active risks and limit access to GitLab Tags RSS Feed endpoints so untrusted users cannot read user email addresses.
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-5612?
CVE-2023-5612 is classified as a critical vulnerability due to its impact on user privacy.
How do I fix CVE-2023-5612?
To fix CVE-2023-5612, update GitLab to version 16.6.6 or higher, or to versions 16.7.4 or 16.8.1.
What versions are affected by CVE-2023-5612?
CVE-2023-5612 affects all GitLab versions prior to 16.6.6, 16.7 before 16.7.4, and 16.8 before 16.8.1.
What information was exposed in CVE-2023-5612?
CVE-2023-5612 allowed unauthorized access to user email addresses via the tags feed.
Can CVE-2023-5612 affect both GitLab Community and Enterprise editions?
Yes, CVE-2023-5612 impacts both GitLab Community and Enterprise editions.