CVE-2023-6051 — Code Injection in Gitlab

CWE-94 — Code Injection5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 58.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedDec 15

Description

An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab16.5 — 16.5.4+1
▶NVDgitlab/gitlab16.5.0 — 16.5.4+2
▶debiandebian/gitlab< gitlab 16.4.4+ds2-2 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2023-6051: An issue has been discovered in GitLab CE/EE affecting all versions before 16↗2023-12-15
▶
GHSA
GHSA-pq7v-xh7j-pwmx: An issue has been discovered in GitLab CE/EE affecting all versions before 16↗2023-12-15
▶

📋Vendor Advisories

2
GitLab
CVE-2023-6051: An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions startin↗2023-12-15
▶
Debian
CVE-2023-6051: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions before 16.4....↗2023
▶