CVE-2023-5933
published 2024-01-26CVE-2023-5933: An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.68%
47.9th percentile
An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 16.6.6-1 (sid) | gitlab 16.6.6-1 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 13.7 < 16.6.6 | 16.6.6 |
| gitlab | gitlab | >= 13.7.0 < 16.6.6 | 16.6.6 |
| gitlab | gitlab | >= 16.7 < 16.7.4 | 16.7.4 |
| gitlab | gitlab | >= 16.7.0 < 16.7.4 | 16.7.4 |
| gitlab | gitlab | >= 16.8 < 16.8.1 | 16.8.1 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
osv5.4MEDIUM
vendor_debian6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-84m5-rqxq-483p: An issue has been discovered in GitLab CE/EE affecting all versions after 13
ghsa_unreviewed·2024-01-26
CVE-2023-5933 [MEDIUM] CWE-79 GHSA-84m5-rqxq-483p: An issue has been discovered in GitLab CE/EE affecting all versions after 13
An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.
OSV
CVE-2023-5933: An issue has been discovered in GitLab CE/EE affecting all versions after 13
osv·2024-01-26·CVSS 5.4
CVE-2023-5933 [MEDIUM] CVE-2023-5933: An issue has been discovered in GitLab CE/EE affecting all versions after 13
An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.
GitLab
CVE-2023-5933: An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper
vendor_gitlab·2024-01-26·CVSS 6.4
CVE-2023-5933 [MEDIUM] CWE-80 CVE-2023-5933: An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper
CVE-2023-5933: An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.
Debian
CVE-2023-5933: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 b...
vendor_debian·2023·CVSS 6.4
CVE-2023-5933 [MEDIUM] CVE-2023-5933: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 b...
An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.
Scope: local
sid: resolved (fixed in 16.6.6-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/https://gitlab.com/gitlab-org/gitlab/-/issues/430236https://hackerone.com/reports/2225710https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/https://gitlab.com/gitlab-org/gitlab/-/issues/430236https://hackerone.com/reports/2225710
2024-01-26
Published