CVE-2023-0989

An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration.

CVSS v3.1

5.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2023-09-29

Updated

2025-11-20

Proof-of-concept exploits (1)

• https://hackerone.com/reports/1875515

References

• CVE Record
• NVD entry

Related

• CVE-2023-0988
• CVE-2023-0994
• CVE-2023-0987
• CVE-2023-0995
• CVE-2023-0983
• CVE-2023-0997