MEDIUM

CVE-2023-3509

Gitlab GitLab 2024-02-21 CVSS v3.1

CVSS

5.4

Description

An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group.

Summary dbcve.org

A broken access control vulnerability in GitLab allowed group members with sub-maintainer role to modify titles of privately accessible deploy keys associated with projects within the group, bypassing intended authorization restrictions.

Mitigation

Upgrade GitLab to version 16.7.6, 16.8.3, 16.9.1 or later to patch the improper authorization check.

Weakness (CWE)

CWE-863 Incorrect Authorization

EPSS Score

0.32%

Probability of exploitation in next 30 days

25.5th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/issues/416945 Broken Link, Permissions Required https://hackerone.com/reports/2037814 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE