Loading vulnerability…
Security Policy Project Disclosure in GitLab EE
CVE-2023-4002 is an information disclosure vulnerability in GitLab EE affecting versions from 14.1 before 16.0.8, 16.1 before 16.1.3, and 16.2 before 16.2.2. EE-licensed users could link any security policy project by its ID to projects or groups they have access to, which could result in the exposure of the security project's configured security policies. This could allow unauthorized users to view sensitive security policy configurations.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability allows unauthorized disclosure of security policy configurations from security policy projects. This could provide attackers with insight into an organization's security posture, detection rules, or response strategies, potentially facilitating further attacks or evasion of security controls.
If you can’t patch tonight, do this now.
Restrict access to security policy projects and monitor for unauthorized linking activity until the affected GitLab EE instances can be upgraded.
Patch, then assume compromise.
Upgrade GitLab EE to version 16.0.8, 16.1.3, or 16.2.2 or later, which contain the fix for this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.