BIT-gitlab-2023-5332

vendorUSosv

Dependency on Vulnerable Third-Party Component in GitLab

view advisory published 2024-03-06Licence: per source

Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-5332US	high8.1	0.87% (59th)	—	2023-12-04
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be b…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8171EVIDENCE
https://nvd.nist.gov/vuln/detail/CVE-2023-5332WEB
https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurationsADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan