CVE-2023-0989
Description
An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration.
Summary dbcve.org
This is an information disclosure vulnerability in GitLab CE/EE that allows attackers to extract non-protected CI/CD variables by tricking users into visiting a fork containing malicious CI/CD configuration. The attack exploits the trust relationship between users and forked repositories, accessing sensitive variable data that should not be exposed.
Mitigation
Upgrade GitLab to version 16.2.8, 16.3.5, 16.4.1 or later. Additionally, review CI/CD variable configurations to ensure only necessary variables are defined and consider marking sensitive variables as protected.