CVE-2023-0326

4.3MEDIUM

Key Information:

Vendor: GitLab
Status: GitLab DAST API scanner
Vendor: CVE Published:; 27 March 2023

Summary

An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headers was leaked in vulnerability report evidence.

Affected Version(s)

GitLab DAST API scanner >=1.6.50, <2.11.0

References

https://gitlab.com/gitlab-org/gitlab/-/issues/388132

https://hackerone.com/reports/1826896

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE...

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Mar 27, 2023
Vulnerability Reserved
Jan 16, 2023

Collectors

NVD DatabaseMitre Database

Credit

Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program