{"id":"CVE-2023-2620","published":"2023-07-13T02:11:05Z","modified":"2024-11-06T14:22:24Z","title":"Insertion of Sensitive Information Into Sent Data in GitLab","vendor":"GitLab","product":"GitLab","tier":"tail","description":{"text":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00549,"percentile":0.45828,"provenance":"source"},"cwes":[{"id":"CWE-201","name":"Insertion of Sensitive Information Into Sent Data"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/410433","tags":["issue-tracking"]},{"url":"https://hackerone.com/reports/1976206","tags":["technical-description","exploit"]}],"priority":{"score":18.0,"factors":[{"name":"EPSS percentile","points":9.17},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.85}]},"vendorSlug":"gitlab","affectedVersions":[{"vendor":"GitLab","product":"GitLab","versions":[">= 15.1, < 15.11.10",">= 16.0, < 16.0.6",">= 16.1, < 16.1.1"]}],"euvd":{"id":"EUVD-2023-34091","exploited":false,"provenance":"source"},"exploitRefs":["https://hackerone.com/reports/1976206"],"lineage":{"familyId":"fam-gitlab-cve-2022-4342","parents":[{"from":"CVE-2023-0838","to":"CVE-2023-2620","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This addresses an incomplete fix for CVE-2023-0838.","from":"CVE.org","in":"CVE-2023-2620"}]}]}}