CVE-2023-4002
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
An issue has been discovered in GitLab EE affecting all versions from 14.1 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. EE-licensed users could link any security policy project by its ID to projects or groups they have access to, potentially revealing the security project's configured security policies.
Risk Assessment
The potential exposure of sensitive information regarding security policies may lead to data security breaches within the organization. Users may inadvertently gain access to information that should be protected.
Recommendation
It is recommended to update GitLab EE to the latest version to mitigate this vulnerability. Additionally, conduct an access audit for projects and groups to minimize the risk of information exposure.
Original NVD description (English source)
An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's configured security policies.