Vulnerability · Published Sep 29, 2023 · Assigned by GitLab
CVE-2023-3115Incorrect User Management in GitLab
Medium 5.4
In plain English
A medium-severity security flaw in GitLab from GitLab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 64.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories.
Affected products (as reported)
Weakness: CWE-286 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- GitLab Issue #414367 issue-tracking
- HackerOne Bug Bounty Report #2004158 technical-description, exploit, permissions-required