CVE-2023-3950
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured.
Risk Assessment
The disclosure of the public key may lead to unauthorized access to audit data, posing a security risk to the organization.
Recommendation
It is recommended to update GitLab EE to version 16.2.5 or 16.3.1 to mitigate the risk associated with the public key disclosure.
Original NVD description (English source)
An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.