CVE-2023-4002

MEDIUM

GitLab EE <16.0.8, <16.1.3, <16.2.2 - Info Disclosure

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's configured security policies.

References (1)

Core 1
Core References
Broken Link issue-tracking permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/416647

Scores

CVSS v3 5.3
EPSS 0.0007
EPSS Percentile 22.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-201
Status published
Products (4)
GitLab/GitLab 14.1 - 16.0.8
gitlab/gitlab 14.1.0 - 16.0.8
GitLab/GitLab 16.1.0 - 16.1.3
GitLab/GitLab 16.2.0 - 16.2.2
Published Aug 04, 2023
Tracked Since Feb 18, 2026