CVE-2023-0838

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=15.1, <15.8.5; >=15.9, <15.9.4; >=15.10, <15.10.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0838.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/391685Broken Link
https://hackerone.com/reports/1871136Permissions Required
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0838.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/391685Broken Link
https://hackerone.com/reports/1871136Permissions Required

Timeline

Published: Apr 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-08399.8Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. InSCADA allows Account Footprinting. CVE-2023-08405.4A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?a CVE-2023-08418.8A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_CVE-2023-08425.3xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does CVE-2023-08444.8The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such CVE-2023-08456.5Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server an CVE-2023-08466.1Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian cou CVE-2023-08478.1The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementati CVE-2023-08487.5A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of th CVE-2023-08499.8A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the com CVE-2023-08507.5A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the co CVE-2023-08519.8Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an a