Loading vulnerability…
GitLab Email Disclosure Through Group Membership Error Message
CVE-2023-1210 is an information-disclosure vulnerability in GitLab CE and EE. In affected versions, an error message associated with groups that restrict membership by email domain could disclose a user's email address. The issue affects versions from 12.9 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker could obtain a user's email address, including the email address of a newly created user, through an error message generated by a group with email-domain membership restrictions.
If you can’t patch tonight, do this now.
As a temporary mitigation, administrators can limit group visibility and restrict group join operations to trusted users until the patch is applied. Monitoring for suspicious group join attempts may also help detect exploitation attempts.
Patch, then assume compromise.
Upgrade GitLab CE or EE to a patched release: 16.0.8, 16.1.3, or 16.2.2, as appropriate for the deployment branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.