BIT-gitlab-2023-5612

vendorUSosv

Missing Authorization in GitLab

view advisory published 2024-03-06Licence: per source

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-5612US	medium5.3OT elevated	4.87% (92nd)	Exploit	2024-01-26
An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags…

references

External citations — patches, advisories, analysis.

https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ADVISORY
https://gitlab.com/gitlab-org/gitlab/-/issues/428441WEB
https://hackerone.com/reports/2208790WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-5612WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan