Vulnerability · Published Nov 6, 2023 · Assigned by GitLab

CVE-2023-5831Insertion of Sensitive Information Into Sent Data in GitLab

Low 3.7

In plain English

A low-severity security flaw in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.5%top 54.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the `super_sidebar_logged_out` feature flag enabled. Affected versions with this default-disabled feature flag enabled may unintentionally disclose GitLab version metadata to unauthorized actors.

Affected products (as reported)

Vendor	Product	Versions
GitLab	GitLab	16.0 – before 16.3.616.4 – before 16.4.216.5 – before 16.5.1

Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitLab Issue #428919 issue-tracking