HIGH
CVE-2023-3413
CVSS
7.5
Description
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to read the source code of a project through a fork created before changing visibility to only project members.
Summary dbcve.org
GitLab versions 16.2.x before 16.2.8, 16.3.x before 16.3.5, and 16.4.x before 16.4.1 had an authorization bypass where forks created before restricting project visibility retained read access to the parent project's source code after the visibility was changed to 'only project members'.
Mitigation
Upgrade GitLab to version 16.2.8, 16.3.5, 16.4.1 or later. Review existing forks to ensure unauthorized access has not occurred.
Weakness (CWE)
CWE-201
EPSS Score
0.62%
Probability of exploitation in next 30 days
48.5th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.