CVE-2023-3399CWE-201

Insertion of Sensitive Information Into Sent Data in GitLab

High · published November 6, 2023

CVSS v3.1
8.5
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.2th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2023-11-06T12:08Z
EPSS history
Timeline
  • 06 NOV 12:08Z
    Insertion of Sensitive Information Into Sent Data in GitLab
    cvelistv5