HIGH

CVE-2023-5332

Gitlab GitLab 2023-12-04 CVSS v3.1

CVSS

8.1

Description

Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.

EPSS Score

0.74%

Probability of exploitation in next 30 days

53.2th percentile

References

https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8171 Exploit, Issue Tracking https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations Patch, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE