Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
debiancveDebian Security Bug TrackerDEBIANCVE:CVE-2023-4378
HistorySep 01, 2023 - 11:15 a.m.

CVE-2023-4378

2023-09-0111:15:43
Debian Security Bug Tracker
security-tracker.debian.org
8
gitlab
vulnerability
sentry token
security issue
incomplete fix

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.2%

JSON

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365.

OSVersionArchitecturePackageVersionFilename
Debian999allgitlab< 16.4.4+ds2-2gitlab_16.4.4+ds2-2_all.deb

Related

cvelist 2
nessus 5
prion 2
cve 2
ubuntucve 2
nvd 2
osv 4
veracode 2
debiancve 1
freebsd 2
cvelist
cvelist
CVE-2023-4378 Exposure of Sensitive Information to an Unauthorized Actor in GitLab
2023-09-01 10:30:31
CVE-2022-4365
2023-01-12 00:00:00
nessus
nessus
GitLab 11.8 < 16.1.5 / 16.2 < 16.2.5 / 16.3 < 16.3.1 (CVE-2023-4378)
2024-05-17 00:00:00
GitLab 11.8 < 15.5.7 / 15.6 < 15.6.4 / 15.7 < 15.7.2 (CVE-2022-4365)
2024-01-03 00:00:00
GitLab < 15.5.7 / 15.6 < 15.6.4 / 15.7 < 15.7.2 (CVE-2022-4365)
2023-02-08 00:00:00
prion
prion
Design/Logic Flaw
2023-09-01 11:15:00
Code injection
2023-01-12 04:15:00
cve
cve
CVE-2023-4378
2023-09-01 11:15:43
CVE-2022-4365
2023-01-12 04:15:10
ubuntucve
ubuntucve
CVE-2023-4378
2023-09-01 00:00:00
CVE-2022-4365
2023-01-12 00:00:00
nvd
nvd
CVE-2023-4378
2023-09-01 11:15:43
CVE-2022-4365
2023-01-12 04:15:10
osv
osv
CVE-2023-4378
2023-09-01 11:15:43
BIT-gitlab-2023-4378
2024-03-06 10:59:51
CVE-2022-4365
2023-01-12 04:15:10
veracode
veracode
Information Disclosure
2023-08-07 00:36:45
Improper Access Control
2023-12-26 19:43:44
debiancve
debiancve
CVE-2022-4365
2023-01-12 04:15:10
freebsd
freebsd
Gitlab -- Multiple Vulnerabilities
2023-01-09 00:00:00
Gitlab -- Vulnerabilities
2023-08-31 00:00:00

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.2%

JSON
Related for DEBIANCVE:CVE-2023-4378
cvelist2nessus5prion2cve2ubuntucve2nvd2osv4veracode2debiancve1freebsd2