CVE-2023-4532
published 2023-09-29CVE-2023-4532: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions…
PriorityP419medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.44%
35.2th percentile
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cloudflare | miniflare | >= 3.20230821.0 < 3.20231030.2 | 3.20231030.2 |
| debian | gitlab | < gitlab 16.4.4+ds2-2 (sid) | gitlab 16.4.4+ds2-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 16.2 < 16.2.8 | 16.2.8 |
| gitlab | gitlab | >= 16.3 < 16.3.5 | 16.3.5 |
| gitlab | gitlab | >= 16.3.0 < 16.3.5 | 16.3.5 |
| gitlab | gitlab | >= 16.4 < 16.4.1 | 16.4.1 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2023-4532: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all ver
vendor_gitlab·2023-09-29·CVSS 4.3
CVE-2023-4532 [MEDIUM] CWE-863 CVE-2023-4532: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all ver
CVE-2023-4532: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.
Debian
CVE-2023-4532: gitlab - An issue has been discovered in GitLab affecting all versions starting from 16.2...
vendor_debian·2023·CVSS 4.3
CVE-2023-4532 [MEDIUM] CVE-2023-4532: gitlab - An issue has been discovered in GitLab affecting all versions starting from 16.2...
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.
Scope: local
sid: resolved (fixed in 16.4.4+ds2-2)
GHSA
Miniflare vulnerable to Server-Side Request Forgery (SSRF)
ghsa·2023-12-29
CVE-2023-7078 [HIGH] CWE-918 Miniflare vulnerable to Server-Side Request Forgery (SSRF)
Miniflare vulnerable to Server-Side Request Forgery (SSRF)
### Impact
Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in `wrangler` until `3.19.0`), an attacker on the local network could access other local servers.
### Patches
The issue was fixed in `[email protected]`.
### Workarounds
Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the `host: "127.0.0.1"` option.
### References
- https://github.com/cloudflare/workers-sdk/pull/4532
OSV
CVE-2023-4532: An issue has been discovered in GitLab affecting all versions starting from 16
osv·2023-09-29·CVSS 4.3
CVE-2023-4532 [MEDIUM] CVE-2023-4532: An issue has been discovered in GitLab affecting all versions starting from 16
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.
GHSA
GHSA-cpg4-gv23-mpmj: An issue has been discovered in GitLab affecting all versions starting from 16
ghsa_unreviewed·2023-09-29
CVE-2023-4532 [MEDIUM] CWE-200 GHSA-cpg4-gv23-mpmj: An issue has been discovered in GitLab affecting all versions starting from 16
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-09-29
Published