CVE-2023-5009 — Incorrect Authorization in Gitlab

CWE-863 — Incorrect AuthorizationCWE-284 — Improper Access Control7 documents6 sources
Severity
9.8CRITICALNVD
EPSS
0.0%
top 87.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedSep 19
Latest updateSep 12

Description

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶NVDgitlab/gitlab13.12 — 16.2.7+1
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-g4c2-hhjc-4hgg: An issue has been discovered in GitLab EE affecting all versions starting from 13↗2023-09-19
▶

📋Vendor Advisories

2
GitLab
CVE-2023-5009: An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It↗2023-09-19
▶
Debian
CVE-2023-5009: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1...↗2023
▶

🕵️Threat Intelligence

3
Bleepingcomputer
GitLab warns of critical pipeline execution vulnerability↗2024-09-12
▶
Wiz
Crying Out Cloud - September Newsletter | Wiz↗2023-10-05
▶
Bleepingcomputer
GitLab urges users to install security updates for critical pipeline flaw↗2023-09-19
▶