PT-2023-16180 · Gitlab · Gitlab Dast Api Scanner

Joaxcaron · Published 2023-03-27 · Updated 2023-04-03 · CVE-2023-0326

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab DAST API scanner versions 1.6.50 through 2.11.0

Description An issue has been discovered in the GitLab DAST API scanner where Authorization headers were leaked in vulnerability report evidence.

Recommendations For GitLab DAST API scanner versions 1.6.50 through 2.11.0, update to version 2.11.0 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2023-0326

Affected Products

Gitlab Dast Api Scanner

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0326.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/388132 · Exploit
• https://osv.dev/vulnerability/CVE-2023-0326 · Vendor Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0326.json · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0326 · Security Note
• https://hackerone.com/reports/1826896 · Note
• https://t.me/cibsecurity/60846 · Telegram Post