Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2023-3950: GitLab lets other group owners view logging key
CVE-2023-3950 · published 3 years ago
Summary
In certain GitLab versions, a group owner could see the public key used for Google Cloud Logging audit streams, even though they should only be able to add it. This could expose details about your logging configuration. Update GitLab to the latest release to restrict the key to write‑only access.
What to do
- Update gitlab to version 16.3.1.
- Update gitlab gitlab to version 16.2.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | gitlab |
>= 16.3.0, < 16.3.1 Fix: upgrade to 16.3.1
|
| – | gitlab | gitlab |
>= 16.2, < 16.2.5 16.3.0 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
Cleartext Storage of Sensitive Information in GitLab
An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3950.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-3950 Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/419675 Third Party Advisory
- https://hackerone.com/reports/2079154 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-312Cleartext Storage of Sensitive Information
Timeline
Published1 Sep 2023
Updated4 Nov 2026
First seen2 Apr 2026
Track software like this
Free during beta