Description
An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 16.2 – < 16.2.5, 16.3 – < 16.3.1 | 16.2.5 |
Advisories 1
- WID-SEC-2023-2244 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 3, 2023
References
- GitLab Issue #419675 issue-tracking permissions-required
- HackerOne Bug Bounty Report #2079154 technical-description exploit permissions-required