MEDIUM

CVE-2023-0319

Gitlab GitLab 2023-04-05 CVSS v3.1

CVSS

5.3

Description

An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1, allowing to read environment names supposed to be restricted to project memebers only.

Summary dbcve.org

This is an information disclosure vulnerability in GitLab where environment names that should be restricted to project members are exposed to unauthorized users. It appears to be an access control bypass (likely IDOR) affecting all versions from 13.6 through the affected version ranges.

Mitigation

Upgrade GitLab to version 15.8.5, 15.9.4, or 15.10.1 or later to patch the unauthorized environment name disclosure.

Weakness (CWE)

CWE-863 Incorrect Authorization

CWE-284 Improper Access Control

EPSS Score

0.74%

Probability of exploitation in next 30 days

53.3th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0319.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/388096 Broken Link https://hackerone.com/reports/1817586 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE