An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork.
References
| Link | Resource |
|---|---|
| https://hackerone.com/reports/1837937 | Permissions Required |
| https://gitlab.com/gitlab-org/gitlab/-/issues/389191 | Broken Link |
| https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0485.json | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
09 May 2023, 19:53
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gitlab gitlab
Gitlab |
|
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | |
| CWE | CWE-668 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | (CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0485.json - Third Party Advisory | |
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/389191 - Broken Link | |
| References | (MISC) https://hackerone.com/reports/1837937 - Permissions Required |
03 May 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-03 21:15
Updated : 2023-05-09 19:53
NVD link : CVE-2023-0485
Mitre link : CVE-2023-0485
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-668
Exposure of Resource to Wrong Sphere