CVE-2023-3950

CVSS V2 None CVSS V3 None

Description

An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.

Overview

CVE ID
CVE-2023-3950

Assigner
GitLab

Vulnerability Status
PUBLISHED

Published Version
2023-09-01T10:30:46.990Z

Last Modified Date
2023-09-01T10:30:46.990Z

Weakness Enumerations

CWE	URL
CWE-312	http://cwe.mitre.org/data/definitions/312.html

References

Reference URL	Reference Tags
https://gitlab.com/gitlab-org/gitlab/-/issues/419675	issue-tracking
https://hackerone.com/reports/2079154	technical-description exploit

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-3950
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3950

History

Created	Old Value	New Value	Data Type	Notes
2024-06-24 21:02:25				Added to TrackCVE