An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance.
References
| Link | Resource |
|---|---|
| https://hackerone.com/reports/1888690 | Permissions Required |
| https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1265.json | Third Party Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/394960 | Broken Link |
Configurations
Configuration 1 (hide)
|
History
09 May 2023, 20:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1265.json - Third Party Advisory | |
| References | (MISC) https://hackerone.com/reports/1888690 - Permissions Required | |
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/394960 - Broken Link | |
| CWE | CWE-384 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.5 |
| First Time |
Gitlab gitlab
Gitlab |
|
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* |
03 May 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-03 21:15
Updated : 2023-05-09 20:37
NVD link : CVE-2023-1265
Mitre link : CVE-2023-1265
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-384
Session Fixation