An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/417594 | Exploit |
| https://hackerone.com/reports/2057633 | Permissions Required |
| https://gitlab.com/gitlab-org/gitlab/-/issues/417594 | Exploit |
| https://hackerone.com/reports/2057633 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:18
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.2 |
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/417594 - Exploit | |
| References | () https://hackerone.com/reports/2057633 - Permissions Required |
03 Oct 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-286 |
20 Oct 2023, 20:04
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/417594 - Exploit |
08 Aug 2023, 17:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/417594 - Broken Link | |
| References | (MISC) https://hackerone.com/reports/2057633 - Permissions Required | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Gitlab gitlab
Gitlab |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
03 Aug 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-03 05:15
Updated : 2024-11-21 08:18
NVD link : CVE-2023-3932
Mitre link : CVE-2023-3932
CVE.ORG link : CVE-2023-3932
JSON object : View
Products Affected
gitlab
- gitlab
CWE