CVE-2023-3399
Last modified
CVE-2023-3399 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.. EPSS estimates a 0.45% chance of exploitation in the next 30 days.
Description
An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 11.6.0, < 12.9.8 |
| Gitlab | Gitlab | >= 12.10.0, < 12.10.7 |
| Gitlab | Gitlab | 13.0.0 |
References
- https://hackerone.com/reports/2021616Permissions Required
- https://hackerone.com/reports/2021616Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-3399?
How severe is CVE-2023-3399?
How do I fix CVE-2023-3399?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-33984SAP NetWeaver (Design Time Repository) - version 7.50, retur…5.4
- CVE-2023-33985SAP NetWeaver Enterprise Portal - version 7.50, does not suf…6.1
- CVE-2023-33986SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, …6.1
- CVE-2023-33987An unauthenticated attacker in SAP Web Dispatcher - versions…9.4
- CVE-2023-33988In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE…6.1
- CVE-2023-33989An attacker with non-administrative authorizations in SAP Ne…8.1
- CVE-2023-33990SAP SQL Anywhere - version 17.0, allows an attacker to preve…7.1
- CVE-2023-33991SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754…8.2
- CVE-2023-33992The SAP BW BICS communication layer in SAP Business Warehous…6.5
- CVE-2023-33993B1i module of SAP Business One - version 10.0, application a…7.5
- CVE-2023-33994Missing Authorization vulnerability in VeronaLabs Slimstat A…6.5
- CVE-2023-33995Missing Authorization vulnerability in Photo Gallery Team Ph…4.3
Are you affected by CVE-2023-3399?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST