CVE-2023-2233 is an improper authorization vulnerability in GitLab CE/EE, affecting versions 11.8 through 16.2.7, 16.3 through 16.3.4, and 16.4 through 16.4.0. This flaw allows a project reporter to access and leak the owner's Sentry instance projects. Rated as Medium severity with a CVSS score of 4.3, the vulnerability has a low attack complexity and requires low privileges, but only results in a low impact on confidentiality. There is no evidence of active exploitation, and no public exploit code or Metasploit/Nuclei modules are available. Community discussion and media coverage are minimal, indicating low current attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 11.8, < 16.2.8CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 11.8, < 16.2.8CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 16.3.0, < 16.3.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* | ||
>= 16.3.0, < 16.3.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
16.4.0CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:16.4.0:*:*:*:community:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.