An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/423835 | Broken Link Vendor Advisory |
| https://hackerone.com/reports/2104540 | Permissions Required Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
06 Dec 2023, 19:22
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.1 |
| First Time |
Gitlab gitlab
Gitlab |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/423835 - Broken Link, Vendor Advisory | |
| References | () https://hackerone.com/reports/2104540 - Permissions Required, Third Party Advisory | |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:16.6.0:*:*:*:enterprise:*:*:* |
01 Dec 2023, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-01 07:15
Updated : 2024-10-03 07:15
NVD link : CVE-2023-4658
Mitre link : CVE-2023-4658
JSON object : View
Products Affected
gitlab
- gitlab
CWE