PT-2023-8247 · Gitlab · Gitlab Ce/Ee+1
Ali_Shehab
·
Publicado
2023-09-06
·
Atualizado
2024-10-03
·
CVE-2023-4812
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:M/Au:N/C:P/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
GitLab EE versions 15.3 through 16.5.6
GitLab EE versions 16.6 through 16.6.4
GitLab EE versions 16.7 through 16.7.2
Description
The issue is related to insufficient access control to the CODEOWNERS file in GitLab EE, allowing a remote attacker to bypass required approvals by adding changes to a previously approved merge request. This could potentially lead to unauthorized access, modification, or deletion of data.
Recommendations
For versions 15.3 through 16.5.6, update to version 16.5.6 or later to resolve the issue.
For versions 16.6 through 16.6.4, update to version 16.6.4 or later to resolve the issue.
For versions 16.7 through 16.7.2, update to version 16.7.2 or later to resolve the issue.
As a temporary workaround, consider restricting access to the CODEOWNERS file to minimize the risk of exploitation.
Exploit
Correção
Improper Access Control
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Gitlab
Gitlab Ce/Ee