CVE-2023-3979
Assigner: GitLab
Published: 2023-09-29T06:02:06.310Z
State: PUBLISHED
title: Exposure of Sensitive Information to an Unauthorized Actor in GitLab
descriptions: value: An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch. 
affected: vendor: GitLab
product: GitLab
repo: git://git@gitlab.com:gitlab-org/gitlab.git
versions: version: 10.6
status: affected
lessThan: 16.2.8
versionType: semver
version: 16.3
status: affected
lessThan: 16.3.5
versionType: semver
version: 16.4
status: affected
lessThan: 16.4.1
versionType: semver
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
cweId: CWE-200
type: CWE
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
solutions: value: Upgrade to version 16.4.1, 16.3.5, 16.2.8
credits: value: Thanks [theluci](https://hackerone.com/theluci) for reporting this vulnerability through our HackerOne bug bounty program
type: finder