CVE-2023-2576

Thursday, July 13, 2023

4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected branch.

Affected Software

Vendor	Product	Version Range	Status
GitLab	GitLab	`13.7 < 15.11.10`	affected
GitLab	GitLab	`16.0 < 16.0.6`	affected
GitLab	GitLab	`16.1 < 16.1.1`	affected

Weaknesses

CWE-863: CWE-863: Incorrect Authorization

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

SSVC:
Exploitation: poc
- Automatable: no
- Technical Impact: partial

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.