CVE-2023-4378
Insertion of Sensitive Information Into Sent Data in GitLab
概要
Insertion of Sensitive Information Into Sent Data in GitLab
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365.
影響パッケージ
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"11.8.0"},{"fixed":"16.1.5"},{"introduced":"16.2.0"},{"fixed":"16.2.5"},{"introduced":"16.3.0"},{"fixed":"16.3.1"}]}]
参照URL
- web gitlab.com
- web hackerone.com
- web nvd.nist.gov