PT-2023-5661 · Gitlab · Gitlab Ce/Ee+1

Published 2023-09-30 · Updated 2024-10-03 · CVE-2023-5207

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GitLab CE and EE versions 16.0 through 16.2.7 GitLab CE and EE versions 16.3 through 16.3.4 GitLab CE and EE versions 16.4 through 16.4.0

Description A vulnerability was discovered in GitLab CE and EE, affecting the control access mechanism. This issue allows an authenticated attacker to perform arbitrary pipeline execution under the context of another user. The vulnerability is related to insufficient control access, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For GitLab CE and EE versions 16.0 through 16.2.7, update to version 16.2.8 or later. For GitLab CE and EE versions 16.3 through 16.3.4, update to version 16.3.5 or later. For GitLab CE and EE versions 16.4 through 16.4.0, update to version 16.4.1 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-250

CWE-284

Related Identifiers

BDU:2023-06328

BIT-GITLAB-2023-5207

CVE-2023-5207

Affected Products

Gitlab

Gitlab Ce/Ee

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5207.json · Exploit
• 🔥 https://hackerone.com/reports/2174141 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-5207 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5207 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06328 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-5207 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/699664 · Security Note
• https://ubuntu.com/security/CVE-2023-5207 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2023-5207 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-5207 · Vendor Advisory
• https://vuldb.com/ru/?id.240993 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5207 · Note
• https://access.redhat.com/security/cve/cve-2023-5207 · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/425604 · Note
• https://twitter.com/fletch_ai/status/1710839187472019878 · Twitter Post