BIT-gitlab-2023-6564

vendorUSosv

Incorrect Authorization in GitLab

view advisory published 2024-03-06Licence: per source

An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-6564US	medium6.5	0.38% (31st)	—	2024-02-08
An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to pro…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-com/gl-infra/production/-/issues/17213REPORT
https://nvd.nist.gov/vuln/detail/CVE-2023-6564WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan