5.7

CVE-2023-0989

An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitlab ≫ Gitlab SwEditioncommunity Version >= 13.11 < 16.2.8
Gitlab ≫ Gitlab SwEditionenterprise Version >= 13.11 < 16.2.8
Gitlab ≫ Gitlab SwEditioncommunity Version >= 16.3.0 < 16.3.5
Gitlab ≫ Gitlab SwEditionenterprise Version >= 16.3.0 < 16.3.5
Gitlab ≫ Gitlab Version16.4.0 SwEditioncommunity
Gitlab ≫ Gitlab Version16.4.0 SwEditionenterprise
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.201
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.7 2.1 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
cve@gitlab.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-282 Improper Ownership Management

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.