BIT-gitlab-2023-3950

vendorUSosv

Cleartext Storage of Sensitive Information in GitLab

view advisory published 2024-03-06Licence: per source

An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-3950US	low3.8OT elevated	0.25% (17th)	—	2023-09-01
An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Googl…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/gitlab/-/issues/419675WEB
https://hackerone.com/reports/2079154WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-3950WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan