PT-2023-8247 · Gitlab · Gitlab Ce/Ee+1
Ali_Shehab
·
Published
2023-09-06
·
Updated
2024-10-03
·
CVE-2023-4812
CVSS v2.0
7.8
High
| Vector | AV:N/AC:M/Au:N/C:P/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
GitLab EE versions 15.3 through 16.5.6
GitLab EE versions 16.6 through 16.6.4
GitLab EE versions 16.7 through 16.7.2
Description
The issue is related to insufficient access control to the CODEOWNERS file in GitLab EE, allowing a remote attacker to bypass required approvals by adding changes to a previously approved merge request. This could potentially lead to unauthorized access, modification, or deletion of data.
Recommendations
For versions 15.3 through 16.5.6, update to version 16.5.6 or later to resolve the issue.
For versions 16.6 through 16.6.4, update to version 16.6.4 or later to resolve the issue.
For versions 16.7 through 16.7.2, update to version 16.7.2 or later to resolve the issue.
As a temporary workaround, consider restricting access to the CODEOWNERS file to minimize the risk of exploitation.
Exploit
Fix
Improper Access Control
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gitlab
Gitlab Ce/Ee