p PatchFirst

CVE-2023-5117

CVE-2023-5117 · Exposure of Sensitive Information Due to Incompatible Policies in GitLab

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in GitLab CE/EE affecting all versions before 17.6.0 in which users were unaware that files uploaded to comments on confidential issues and epics of public projects could be accessed without authentication via a direct link to the uploaded file URL.

CVSS 3.7 · Low · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • gitlab

    Versions
    • ≥ 0, < 17.6.0: Affected (semver)

    Update to 17.6.0

  • gitlab Ubuntu:16.04:LTS

    Versions
    • 8.4.3+dfsg-9
    • 8.4.3+dfsg-12
    • 8.5.8+dfsg-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →