MEDIUM
Incorrect Authorization in GitLab
Published Sep 29, 2023
4.3
MEDIUMCVSS 3.1
EPSS 0.53%
Description
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.
Affected products
-
Affected
- ≥ 16.2, < 16.2.8
- ≥ 16.3, < 16.3.5
- ≥ 16.4, < 16.4.1
-
Affected
- ≥ 16.2, < 16.2.8
- ≥ 16.3, < 16.3.5
- ≥ 16.4, < 16.4.1
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Upgrade to versions 16.4.1, 16.3.5, 16.2.8 or above.
Weaknesses (1)
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54387 Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/423357 issue-trackingpermissions-requiredBroken Link
- https://hackerone.com/reports/2084199 technical-descriptionexploitpermissions-requiredPermissions Required
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54387 | Advisory | |
| https://gitlab.com/gitlab-org/gitlab/-/issues/423357 | issue-trackingpermissions-requiredBroken Link | |
| https://hackerone.com/reports/2084199 | technical-descriptionexploitpermissions-requiredPermissions Required |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitLab
Published Sep 29, 2023
Updated Apr 26, 2026
Reserved Aug 25, 2023
Link CVE-2023-4532
CISA Vulnrichment
Updated Jul 24, 2024
Red Hat
No data
GitHub
No data