CVE-2023-3441
Gitlab 8.0.0 – 16.4.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-3441 is a medium-severity Exposure of Sensitive Information Due to Incompatible Policies (CWE-213) vulnerability in Gitlab Gitlab. Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-16 (Security and Privacy Attributes) and AC-21 (Information Sharing) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-44105
Vulnerability Data
An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 3 OS baselines
V4.1.2V14.1.1
Mitigating Controls (NIST 800-53 r5) AI
Associates security and privacy attributes with data and subjects so that incompatible stakeholder policies can be reconciled before exposure occurs.
Requires explicit checking that a sharing partner's authorizations match the sensitivity of the information, preventing release under mismatched policies.
Enforces approved information flow policies between systems, directly stopping exposure when developer and stakeholder policies conflict.
Documents the specific purposes for processing PII, surfacing and aligning conflicting stakeholder policies before data exposure.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Understanding stakeholder needs directly surfaces incompatible sensitivity expectations that produce the exposure.
Regulatory and privacy obligations often define the conflicting sensitivity views that the weakness fails to reconcile.
Establishing risk-management policy based on organizational context is the primary mechanism for aligning divergent sensitivity rules.
Periodic policy review can detect and correct stakeholder-policy mismatches before they cause exposure.
Defining and enforcing access policy is one concrete place where incompatible sensitivity decisions manifest as unauthorized disclosure.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.1 only requires the existence of an information security policy and topic-specific policies (including on access control); it does not itself enforce compatible policies or stop the exposure that CWE-213 names, per the owner's explicit rule that such governance clauses do not prevent weaknesses
A.5.12 only defines and communicates a classification scheme (a dependency for other controls); per the owner's explicit rule it performs no prevention itself on CWE-213, whose root cause is policy incompatibility rather than absent labels.
Labelling helps communicate classification decisions and reduce policy conflicts.
Transfer rules can enforce consistent protection when data crosses stakeholder boundaries.
A.5.15 defines and communicates access control policy and requirements (including need-to-know, classification consistency, and segregation) but does not itself enforce or implement those rules; per the owner's explicit rule on policy/labeling controls, this is a dependency for other controls (e.g. A.8.3) rather than prevention of the incompatible-policies exposure.
Rights assignment can be aligned with the strictest applicable stakeholder policy.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Ubuntu 24.04 (1 rule)
- V-270708 Ubuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. blocks CWE-213
Windows Server 2019 (1 rule)
- V-205757 Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group. blocks CWE-213