title: Insertion of Sensitive Information into Log File in GitLab
description: An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`.
problem types: CWE-532: Insertion of Sensitive Information into Log File
affected:
{
vendor: GitLab
product: GitLab
repo: git://git@gitlab.com:gitlab-org/gitlab.git
versions:
version: 13.6, status: affected, lessThan: 15.11.10, versionType: semver
version: 16.0, status: affected, lessThan: 16.0.6, versionType: semver
version: 16.1, status: affected, lessThan: 16.1.1, versionType: semver
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
]
solutions: Upgrade to versions 15.11.10, 16.0.6, 16.1.1 or above.