CVE-2023-4378
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
An issue has been discovered in GitLab CE/EE affecting all versions from 11.8 to 16.1.5, from 16.2 to 16.2.5, and from 16.3 to 16.3.1. A malicious Maintainer can, under specific circumstances, leak the Sentry token by changing the configured URL in the Sentry error tracking settings page.
Risk Assessment
The organization may be exposed to the leakage of sensitive information, potentially leading to further attacks or security breaches.
Recommendation
It is recommended to update GitLab to the latest version to mitigate this vulnerability and to monitor Sentry settings for unauthorized changes.
Original NVD description (English source)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365.