CVE-2023-3363 - Insertion of Sensitive Information into Log File in GitLab

Back Back to CVE browser

LOW

Insertion of Sensitive Information into Log File in GitLab

Published Jul 13, 2023

3.9

LOW

CVSS 3.1

EPSS 0.18%

Description

An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  13.6
  Status
  affected
  Constraints
  <15.11.10
- Version
  16.0
  Status
  affected
  Constraints
  <16.0.6
- Version
  16.1
  Status
  affected
  Constraints
  <16.1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
13.6	affected	<15.11.10
16.0	affected	<16.0.6
16.1	affected	<16.1.1

Remediation

Vendor solution

Upgrade to versions 15.11.10, 16.0.6, 16.1.1 or above.

Weaknesses (1)

CWE-532

References (1)

https://gitlab.com/gitlab-org/gitlab/-/issues/409034
issue-trackingBroken Link

Link	Providers	Tags
https://gitlab.com/gitlab-org/gitlab/-/issues/409034		issue-trackingBroken Link

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitLab

Published Jul 13, 2023

Updated Nov 5, 2024

Reserved Jun 22, 2023

Link CVE-2023-3363

CISA Vulnrichment

Updated Nov 5, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-3363

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-3363