CVE-2023-3444

MEDIUM severity · CVSS 5.7 · Incorrect authorization

5.7CVSS MEDIUM

Summary

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

Confidentiality impactNone

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Affected products we track (1)

GitLab

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://gitlab.com/gitlab-org/gitlab/-/issues/406803Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/406803Advisory
https://hackerone.com/reports/1928709Advisory
https://hackerone.com/reports/1928709Advisory