MEDIUM

CVE-2023-3444

Gitlab GitLab 2023-07-13 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches.

Summary dbcve.org

An authorization bypass vulnerability in GitLab CE/EE allows authenticated attackers to merge arbitrary code into protected branches that should restrict such changes, effectively bypassing branch protection controls.

Mitigation

Upgrade GitLab to version 15.11.10, 16.0.6, 16.1.1 or later to patch this authorization bypass in protected branch merge workflows.

Weakness (CWE)

CWE-863 Incorrect Authorization

EPSS Score

0.52%

Probability of exploitation in next 30 days

43.2th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/issues/406803 Issue Tracking, Vendor Advisory https://hackerone.com/reports/1928709 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE