What is CVE-2023-3950?

CVE-2023-3950 is a medium-severity vulnerability in Gitlab, classified under Cleartext Storage of Sensitive Information. CVSS score: 5.5/10. Published 2023-09-01.

How severe is CVE-2023-3950?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Gitlab

CVE-2023-3950

An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.

EPSS: 0.002 (11.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N.

Affected products

Gitlab — versions 16.3.0, 16.2, 16.3

Weakness classification (CWE)

CWE-312 — Cleartext Storage of Sensitive Information

References

cve@gitlab.com (issue-tracking, permissions-required, Broken Link)
cve@gitlab.com (Permissions Required, technical-description, permissions-required, exploit)

Frequently asked questions

What is CVE-2023-3950?: CVE-2023-3950 is a medium-severity vulnerability in Gitlab, classified under Cleartext Storage of Sensitive Information. CVSS score: 5.5/10. Published 2023-09-01.
How severe is CVE-2023-3950?: Medium severity. CVSS v3 base score is 5.5 out of 10.