CVE-2023-5198

Friday, September 29, 2023

4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys.

Affected Software

Vendor	Product	Version Range	Status
GitLab	GitLab	`0 <= 16.2.7`	affected
GitLab	GitLab	`16.3 < 16.3.5`	affected
GitLab	GitLab	`16.4 < 16.4.1`	affected

Weaknesses

CWE-863: CWE-863: Incorrect Authorization

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

SSVC:
Exploitation: poc
- Automatable: no
- Technical Impact: partial

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.