CVE-2023-5600
Last modified
CVE-2023-5600 is a low-severity vulnerability rated 3.1/10 on the CVSS scale. An issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. Arbitrary access to the titles of an private specific references could be leaked through the service-desk custom email template.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
An issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. Arbitrary access to the titles of an private specific references could be leaked through the service-desk custom email template.
Metrics
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 16.0.0, < 16.3.6 |
| Gitlab | Gitlab | >= 16.4.0, < 16.4.2 |
| Gitlab | Gitlab | 16.5.0 |
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/428268Exploit, Issue Tracking
- https://hackerone.com/reports/2209702Permissions Required
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-5600?
How severe is CVE-2023-5600?
How do I fix CVE-2023-5600?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-5593The out-of-bounds write vulnerability in the Windows-based S…7.8
- CVE-2023-5594Improper validation of the server’s certificate chain in sec…8.6
- CVE-2023-5595Denial of Service in GitHub repository gpac/gpac prior to 2.…5.5
- CVE-2023-5597A stored Cross-site Scripting (XSS) vulnerability affecting …5.4
- CVE-2023-5598Stored Cross-site Scripting (XSS) vulnerabilities affecting …5.4
- CVE-2023-5599A stored Cross-site Scripting (XSS) vulnerability affecting …5.4
- CVE-2023-5601The WooCommerce Ninja Forms Product Add-ons WordPress plugin…9.8
- CVE-2023-5602The Social Media Share Buttons & Social Sharing Icons plugin…8.8
- CVE-2023-5604The Asgaros Forum WordPress plugin before 2.7.1 allows forum…9.8
- CVE-2023-5605The URL Shortify WordPress plugin before 1.7.9.1 does not sa…4.8
- CVE-2023-5606The ChatBot for WordPress is vulnerable to Stored Cross-Site…4.8
- CVE-2023-5607 An improper limitation of a path name to a restricted direc…7.2
Are you affected by CVE-2023-5600?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST