Loading vulnerability…
Access Token Exposure via Logging in GitLab EE
CVE-2023-3993 is a vulnerability in GitLab EE (Enterprise Edition) affecting versions from 14.3 before 16.0.8, 16.1 before 16.1.3, and 16.2 before 16.2.2. The vulnerability involves the inadvertent logging of access tokens when a query is made to a specific endpoint, potentially exposing sensitive authentication credentials in log files.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers with access to the affected logs could retrieve access tokens, which may allow them to impersonate users or access sensitive resources, depending on the permissions associated with the leaked tokens. This could lead to unauthorized access, privilege escalation, or data exfiltration.
If you can’t patch tonight, do this now.
Restrict access to log files to only trusted administrators, monitor for unauthorized access to logs, and rotate any potentially exposed access tokens. Consider implementing additional logging controls or redaction mechanisms until the affected GitLab EE instance is upgraded.
Patch, then assume compromise.
Upgrade GitLab EE to version 16.0.8, 16.1.3, 16.2.2, or later to address the vulnerability and prevent access tokens from being logged.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.