---
id: CVE-2023-3399
title: Insertion of Sensitive Information Into Sent Data in GitLab
summary: >-
  An issue has been discovered in GitLab EE affecting all versions starting from
  11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all
  versions starting from 16.5 before 16.5.1. It was possible for an unauthorised
  project …
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-201
vendor: GitLab
product: GitLab
affected:
  - GitLab >= 11.6 < 16.3.6
  - GitLab >= 16.4 < 16.4.2
  - GitLab >= 16.5 < 16.5.1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-07-24T13:40:19.625133Z'
exploitAvailable: true
published: '2023-11-06'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T11:39:49.684Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-3399'
references:
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/416244'
    label: 'GitLab Issue #416244'
  - url: 'https://hackerone.com/reports/2021616'
    label: 'HackerOne Bug Bounty Report #2021616'
tags:
  - cve.org
  - exploit-available
epss: 0.00452
epssPercentile: 0.39063
ingestedAt: '2026-10-28T12:10:35.148Z'
---

## Overview

An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.

## Affected

- `GitLab >= 11.6 < 16.3.6`
- `GitLab >= 16.4 < 16.4.2`
- `GitLab >= 16.5 < 16.5.1`

## Remediation

Upgrade to versions 16.5.1, 16.4.2, 16.3.6 or above.