CVE-2023-3399

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-3399
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3399.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-3399
Aliases
Downstream
Published
2023-11-06T12:08:54.970Z
Modified
2025-12-05T00:49:30.243442Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Insertion of Sensitive Information Into Sent Data in GitLab
Details

An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.

Database specific 
{
    "cwe_ids": [
        "CWE-201"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3399.json",
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
4c09765c6424a96be7c7ae7707db3bda4e9c4ab4
Fixed
128862473d18a7df991090bb25688a8c81fcb0fe
Database specific 
{
    "versions": [
        {
            "introduced": "11.6"
        },
        {
            "fixed": "16.3.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
e4c1c182610739c1b1d10a8eacbea1f5aa837ad6
Fixed
385b9a2727ad972efe1fcdca3a61c447329ecd09
Database specific 
{
    "versions": [
        {
            "introduced": "16.4"
        },
        {
            "fixed": "16.4.2"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
fc87c9d4cca1536abcf902b4128f5c2004d87162
Fixed
55da9ccb652fcf67641114264ecded0dab88f4dc
Database specific 
{
    "versions": [
        {
            "introduced": "16.5"
        },
        {
            "fixed": "16.5.1"
        }
    ]
}

Affected versions

v16.*

v16.4.0-ee
v16.4.1-ee
v16.5.0-ee