CVE-2023-4658 - Incorrect Authorization in GitLab

Back Back to CVE browser

LOW

Incorrect Authorization in GitLab

Published Dec 1, 2023

3.1

LOW

CVSS 3.1

EPSS 0.47%

Description

An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  16.5
  Status
  affected
  Constraints
  <16.5.3
- Version
  16.6
  Status
  affected
  Constraints
  <16.6.1
- Version
  8.13
  Status
  affected
  Constraints
  <16.4.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
16.5	affected	<16.5.3
16.6	affected	<16.6.1
8.13	affected	<16.4.3

Remediation

Vendor solution

Upgrade to versions 16.4.3, 16.5.3, 16.6.1 or above.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54510
Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/423835
issue-trackingpermissions-requiredBroken LinkVendor Advisory
https://hackerone.com/reports/2104540
technical-descriptionexploitpermissions-requiredPermissions RequiredThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54510		Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/423835		issue-trackingpermissions-requiredBroken LinkVendor Advisory
https://hackerone.com/reports/2104540		technical-descriptionexploitpermissions-requiredPermissions RequiredThird Party Advisory