MEDIUM

CVE-2023-1167

Gitlab GitLab 2023-04-05 CVSS v3.1

CVSS

5.3

Description

Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.

Summary dbcve.org

Improper authorization vulnerability in GitLab Enterprise Edition allows unauthorized users to access security reports within merge requests. This occurs due to insufficient access control checks on security report endpoints, enabling attackers to view sensitive vulnerability information they should not have permission to access.

Mitigation

Upgrade GitLab to version 15.8.5, 15.9.4, 15.10.1 or later. Apply the appropriate patch in a staging environment first to verify compatibility before production deployment.

Weakness (CWE)

CWE-862 Missing Authorization

CWE-285 Improper Authorization

EPSS Score

0.56%

Probability of exploitation in next 30 days

45.6th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1167.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/392715 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE