BIT-gitlab-2023-4008

vendorUSosv

Incorrect Ownership Assignment in GitLab

view advisory published 2024-03-06Licence: per source

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-4008US	critical9.8	0.70% (53rd)	—	2023-08-03
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/gitlab/-/issues/415942WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-4008WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan