cve/2023/CVE-2023-2620.md

### [CVE-2023-2620](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2620)
![](https://img.shields.io/static/v1?label=Product&message=GitLab&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=15.1%3C%2015.11.10%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brighgreen)

### Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838.

### POC

#### Reference
- https://gitlab.com/gitlab-org/gitlab/-/issues/410433

#### Github
No PoCs found on GitHub currently.