CVE-2023-4630

2023-09-1114:15:09

CWE-200

GitLab

web.nvd.nist.gov

106

gitlab

cve-2023-4630

security

unauthorized access

information disclosure

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

18.5%

JSON

An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project’s imports.

Affected configurations

Nvd

Vulners

Node

gitlabgitlabRange10.6.0–16.1.5community

gitlabgitlabRange10.6.0–16.1.5enterprise

gitlabgitlabRange16.2.0–16.2.5community

gitlabgitlabRange16.2.0–16.2.5enterprise

gitlabgitlabMatch16.3.0community

gitlabgitlabMatch16.3.0enterprise

VendorProductVersionCPE
gitlabgitlab16.3.0cpe:/a:gitlab:gitlab:16.3.0::community:
gitlabgitlab16.3.0cpe:/a:gitlab:gitlab:16.3.0::enterprise:

Vendor	Product	Version	CPE
gitlab	gitlab	16.3.0	cpe:/a:gitlab:gitlab:16.3.0::community:
gitlab	gitlab	16.3.0	cpe:/a:gitlab:gitlab:16.3.0::enterprise:

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "GitLab",
    "repo": "git://[email protected]:gitlab-org/gitlab.git",
    "vendor": "GitLab",
    "versions": [
      {
        "lessThan": "16.1.5",
        "status": "affected",
        "version": "10.6",
        "versionType": "semver"
      },
      {
        "lessThan": "16.2.5",
        "status": "affected",
        "version": "16.2",
        "versionType": "semver"
      },
      {
        "lessThan": "16.3.1",
        "status": "affected",
        "version": "16.3",
        "versionType": "semver"
      }
    ]
  }
]