CVE-2023-1936

LOW

3.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service desk issue.

CVE Details

CVSS v3.1 Score3.5

SeverityLOW

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

Published7/11/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

gitlab:gitlab

Weaknesses (CWE)

CWE-359

References

https://gitlab.com/gitlab-org/gitlab/-/issues/405150(cve@gitlab.com)

https://hackerone.com/reports/1933829(cve@gitlab.com)

https://gitlab.com/gitlab-org/gitlab/-/issues/405150(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/1933829(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.