Authorization Header Exposure in GitLab DAST API Scanner
CVE-2023-0326

4.3MEDIUM

Key Information:

Vendor
GitLab
Status
GitLab DAST API scanner
Vendor
CVE Published:
27 March 2023

Summary

An issue has been identified in the GitLab DAST API scanner, where authorization headers were unintentionally exposed in vulnerability reports. This exposure affects all versions of the scanner starting from 1.6.50 up to, but not including, version 2.11.0. As a result, sensitive authentication details may have been leaked, increasing the risk of unauthorized access or exploitation of exposed APIs.

Affected Version(s)

GitLab DAST API scanner >=1.6.50, <2.11.0

References

https://gitlab.com/gitlab-org/gitlab/-/issues/388132
https://hackerone.com/reports/1826896
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
.