CVE-2023-2001

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-2001
An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/406764 Broken Link
https://hackerone.com/reports/1908423 Permissions Required Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/406764 Broken Link
https://hackerone.com/reports/1908423 Permissions Required Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/406764 Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
History

07 Jan 2025, 17:15

Type Values Removed Values Added
CWE CWE-290
References () https://gitlab.com/gitlab-org/gitlab/-/issues/406764 - Broken Link () https://gitlab.com/gitlab-org/gitlab/-/issues/406764 - Broken Link

21 Nov 2024, 07:57

Type Values Removed Values Added
References () https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json - Vendor Advisory () https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json - Vendor Advisory
References () https://gitlab.com/gitlab-org/gitlab/-/issues/406764 - Broken Link () https://gitlab.com/gitlab-org/gitlab/-/issues/406764 - Broken Link
References () https://hackerone.com/reports/1908423 - Permissions Required, Third Party Advisory () https://hackerone.com/reports/1908423 - Permissions Required, Third Party Advisory

14 Jun 2023, 01:25

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
CWE NVD-CWE-noinfo
First Time Gitlab gitlab
Gitlab
CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
References (MISC) https://hackerone.com/reports/1908423 - (MISC) https://hackerone.com/reports/1908423 - Permissions Required, Third Party Advisory
References (CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json - (CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json - Vendor Advisory
References (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/406764 - (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/406764 - Broken Link

07 Jun 2023, 17:28

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-07 17:15

Updated : 2025-01-07 17:15

NVD link : CVE-2023-2001

Mitre link : CVE-2023-2001

CVE.ORG link : CVE-2023-2001

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
NVD-CWE-noinfo CWE-290

Authentication Bypass by Spoofing