CVE-2023-1167 — Missing Authorization in Gitlab

CWE-862 — Missing AuthorizationCWE-285 — Improper Authorization4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.3%
top 43.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedApr 5

Description

Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶NVDgitlab/gitlab12.3.0 — 15.8.5+2
▶CVEListV5gitlab/gitlab>=12.3.0, <15.8.5, >=15.10, <15.10.1, >=15.9, <15.9.4+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-7g53-7whp-2hm3: Improper authorization in Gitlab EE affecting all versions from 12↗2023-04-05
▶

📋Vendor Advisories

2
GitLab
CVE-2023-1167: Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions star↗2023-04-05
▶
Debian
CVE-2023-1167: gitlab - Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15...↗2023
▶