Dashboard / CVE-2023-3399

CVE-2023-3399

HIGH
MEDIUM Priority: 0.04 BB Relevance: 67/100
Published: 2023-11-06 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Changed
C: High
I: Low
A: None

Description

An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
GitLab GitLab 11.6 < 16.3.6
GitLab GitLab 16.4 < 16.4.2
GitLab GitLab 16.5 < 16.5.1
GitLab GitLab 11.6 < 16.3.6
GitLab GitLab 16.4 < 16.4.2
GitLab GitLab 16.5 < 16.5.1

References & Advisories (2)

https://hackerone.com/reports/2021616
technical-description exploit permissions-required

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

EPSS — Exploitation Probability

0.45%
Raw Score 0.004520
Percentile 39.1%
Date 2026-10-28

Intelligence Sources

mitre ref →

External Links