MEDIUM

CVE-2023-1621

Gitlab GitLab 2023-06-06 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address.

Summary dbcve.org

GitLab EE fails to properly enforce IP address restrictions for group members. A malicious group member can bypass project-level IP restrictions and continue committing code even when their IP address should be blocked by the configured access policy.

Mitigation

Upgrade GitLab EE to version 15.10.5 or higher, or 15.11.1 or higher. Review existing group membership and IP restriction policies after patching.

EPSS Score

0.87%

Probability of exploitation in next 30 days

57.3th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1621.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/399774 Issue Tracking, Vendor Advisory https://hackerone.com/reports/1914049 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE