CVE-2023-3399

Published Nov 6, 2023

Last updated a month ago

Overview

Description
An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.
Source
cve@gitlab.com
NVD status
Modified

Risk scores

CVSS 3.1

Type
Primary
Base score
7.7
Impact score
4
Exploitability score
3.1
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Severity
HIGH

Weaknesses

nvd@nist.gov
NVD-CWE-Other
cve@gitlab.com
CWE-201

Social media

Hype score
Not currently trending

Configurations