An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/423357 | Broken Link |
| https://hackerone.com/reports/2084199 | Permissions Required |
| https://gitlab.com/gitlab-org/gitlab/-/issues/423357 | Broken Link |
| https://hackerone.com/reports/2084199 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/423357 - Broken Link | |
| References | () https://hackerone.com/reports/2084199 - Permissions Required |
03 Oct 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-863 |
03 Oct 2023, 19:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gitlab
Gitlab gitlab |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:16.4.0:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:16.4.0:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
|
| CWE | NVD-CWE-noinfo | |
| References | (MISC) https://hackerone.com/reports/2084199 - Permissions Required | |
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/423357 - Broken Link |
29 Sep 2023, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-29 07:15
Updated : 2024-11-21 08:35
NVD link : CVE-2023-4532
Mitre link : CVE-2023-4532
CVE.ORG link : CVE-2023-4532
JSON object : View
Products Affected
gitlab
- gitlab
CWE