Vulnerability · Published Dec 17, 2023 · Assigned by GitLab
CVE-2023-3907Improper User Management in GitLab
Medium 4.9
In plain English
A medium-severity security flaw in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.7%top 47.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner
Affected products (as reported)
Weakness: CWE-286 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
References
- GitLab Issue #418878 issue-tracking
- HackerOne Bug Bounty Report #2058934 technical-description, exploit, permissions-required