CVE-2023-4378

{"id": "CVE-2023-4378", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-4378", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-30T15:48:23.298311Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@gitlab.com", "affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "11.8", "lessThan": "16.1.5", "versionType": "semver"}, {"status": "affected", "version": "16.2", "lessThan": "16.2.5", "versionType": "semver"}, {"status": "affected", "version": "16.3", "lessThan": "16.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2023-09-01T11:15:43.113", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/422134", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/2104591", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/422134", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://hackerone.com/reports/2104591", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-201"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 11.8 anteriores a la 16.1.5, todas las versiones a partir de la 16.2 anteriores a la 16.2.5, todas las versiones a partir de la 16.3 anteriores a la 16.3.1. Un mantenedor malicioso puede, bajo circunstancias espec\u00edficas, filtrar el token de Sentry al cambiar la URL configurada en la p\u00e1gina de configuraci\u00f3n de seguimiento de errores de Sentry. Esto fue como resultado de una soluci\u00f3n incompleta para CVE-2022-4365."}], "lastModified": "2026-06-17T06:37:42.350", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "593DB34F-FA65-443F-B5E8-D6C2FA38EC1A", "versionEndExcluding": "16.1.5", "versionStartIncluding": "11.8.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "BF3A9B30-D096-478C-A38E-BC0620852F65", "versionEndExcluding": "16.1.5", "versionStartIncluding": "11.8.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "18116007-7452-495F-80A1-39499882656E", "versionEndExcluding": "16.2.5", "versionStartIncluding": "16.2"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "4E03E8BA-63C8-47D5-B5A1-26DF199E1F65", "versionEndExcluding": "16.2.5", "versionStartIncluding": "16.2"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:16.3.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "EE9B8DE8-9990-494B-BDBE-F867DDBB9D57"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:16.3.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "08D6B555-39B6-493D-8460-3DC998BAF651"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}