CVE-2023-5831: Version information disclosure when super_sidebar_logged_out feature flag is enabled
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this default-disabled feature flag enabled may unintentionally disclose GitLab version metadata to unauthorized actors.
Other sources
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this default-disabled feature flag enabled may unintentionally disclose GitLab version metadata to unauthorized actors. This is a low severity issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, 3.7). It is now mitigated in the latest release and is assigned CVE-2023-5831.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-5831?
CVE-2023-5831 is a vulnerability in GitLab CE/EE that allows unauthorized actors to access sensitive information.
What versions of GitLab are affected by CVE-2023-5831?
GitLab versions starting from 16.0 before 16.3.6, starting from 16.4 before 16.4.2, and starting from 16.5.0 before 16.5.1 (with the `super_sidebar_logged_out` feature flag enabled) are affected by CVE-2023-5831.
How severe is CVE-2023-5831?
CVE-2023-5831 has a severity rating of medium with a CVSS score of 5.3.
How can I fix CVE-2023-5831?
To fix CVE-2023-5831, it is recommended to upgrade GitLab to version 16.3.6, 16.4.2, or 16.5.1 or higher, and disable the `super_sidebar_logged_out` feature flag.
Where can I find more information about CVE-2023-5831?
More information about CVE-2023-5831 can be found at the following reference link: [CVE-2023-5831](https://gitlab.com/gitlab-org/gitlab/-/issues/428919).