CVE-2023-5831: Version information disclosure when super_sidebar_logged_out feature flag is enabled
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this default-disabled feature flag enabled may unintentionally disclose GitLab version metadata to unauthorized actors.
Other sources
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this default-disabled feature flag enabled may unintentionally disclose GitLab version metadata to unauthorized actors. This is a low severity issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, 3.7). It is now mitigated in the latest release and is assigned CVE-2023-5831.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.3.6Fixed in 16.4.2Fixed in 16.5.1 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.3.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.5.1 - Configuration
Disable the default-disabled super_sidebar_logged_out feature flag if it was previously enabled
GitLab CE/EE super_sidebar_logged_out = disabled
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-5831?
CVE-2023-5831 is a vulnerability in GitLab CE/EE that allows unauthorized actors to access sensitive information.
What versions of GitLab are affected by CVE-2023-5831?
GitLab versions starting from 16.0 before 16.3.6, starting from 16.4 before 16.4.2, and starting from 16.5.0 before 16.5.1 (with the `super_sidebar_logged_out` feature flag enabled) are affected by CVE-2023-5831.
How severe is CVE-2023-5831?
CVE-2023-5831 has a severity rating of medium with a CVSS score of 5.3.
How can I fix CVE-2023-5831?
To fix CVE-2023-5831, it is recommended to upgrade GitLab to version 16.3.6, 16.4.2, or 16.5.1 or higher, and disable the `super_sidebar_logged_out` feature flag.
Where can I find more information about CVE-2023-5831?
More information about CVE-2023-5831 can be found at the following reference link: [CVE-2023-5831](https://gitlab.com/gitlab-org/gitlab/-/issues/428919).