CVE-2023-0989

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-282

Affected software

Vendor	Product	Versions
GitLab	GitLab	< 16.2.8; >= 16.3, < 16.3.5; >= 16.4, < 16.4.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/417275Broken Link
https://hackerone.com/reports/1875515Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/417275Broken Link
https://hackerone.com/reports/1875515Permissions Required

Timeline

Published: Sep 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-09926.1The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'Use CVE-2023-09934.3The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, an CVE-2023-09947.5Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.CVE-2023-09955.4Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to v2.0.1.CVE-2023-09967.8There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this throug CVE-2023-09978.8A vulnerability was found in SourceCodester Moosikay E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some un CVE-2023-09985.3A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part CVE-2023-09998.8A vulnerability classified as problematic was found in SourceCodester Sales Tracker Management System 1.0. This vulnerability affects unknow CVE-2023-10006.3A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file d CVE-2023-10013.5A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. This issue affects the function e CVE-2023-10026.5A vulnerability, which was classified as problematic, has been found in MuYuCMS 2.2. This issue affects some unknown processing of the file CVE-2023-10037.8A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown function of the compon