CVE-2023-3441

Exposure of Sensitive Information Due to Incompatible Policies in GitLab

An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches.

Affected

GitLab

CVSS v3.1 NVD

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v3.1 GITLAB

6.6 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

EPSS

0.55% chance of exploitation in the next 30 days, 45th percentile

Published

2024-10-01

Proof-of-concept exploits (3)

• https://gitlab.com/gitlab-org/gitlab/-/issues/417284
• https://hackerone.com/reports/2033561
• https://hackerone.com/reports/2041385

Security advisories

• https://gitlab.com/gitlab-org/gitlab/-/issues/416482

References

• CVE Record
• NVD entry