Lucene search

Veracode Vulnerability DatabaseVERACODE:41464

HistoryJul 22, 2023 - 8:11 a.m.

Information Disclosure

2023-07-2208:11:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

gitlab

information disclosure

vulnerability

search option

authenticated users

private emails

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.7%

JSON

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the library’s search option allows authenticated users to search other users by their respective private emails, even if a user sets their email to private.

References

gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0371.json

gitlab.com/gitlab-org/gitlab/-/issues/350476

security-tracker.debian.org/tracker/CVE-2022-0371

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.7%

JSON

Related for VERACODE:41464