CVE-2023-1936 LOW

CVE-2023-1936: Exposure of Private Personal Information to an Unauthorized Actor in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-359
Published July 11, 2023
Last update November 12, 2024
View on NVD All CVEs

CVSS base score

3.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service desk issue.

Key dates

02Disclosure timeline

July 11, 2023 CVE published
November 12, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-30056 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability CVE-2026-3911 Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint CVE-2025-41685 SMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user CVE-2023-26041 Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab