CVE-2023-6396

highpriority · track · 0DE
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
— EPSS
CVSS 7.1 · high
Is it mine?
7 products
Check your exposure
Who says so?
2 sources
cnnvd · cert_bund

中文Shown in its original language — a full translation is planned for a future version.

GitLab是美国GitLab公司的一个开源的端到端软件开发平台，具有内置的版本控制、问题跟踪、代码审查、CI/CD（持续集成和持续交付）等功能。 GitLab CE/EE存在安全漏洞，该漏洞源于当用户被分配启用了admin_group_member的自定义角色时，他们可能能够将静态角色高于自己的成员添加到组中，可能会导致权限提升。

01

cvss

Technical severity, 0–10. One row per scoring source.

7.1
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:Nsecondary · grimoire (LLM-derived)LLM-inferred
02

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-266USLLM-inferred
03

affected products (7)

Products and version ranges known to be affected.

04

advisories (1)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2023-3041GitLab: Mehrere SchwachstellenDeutsch2023-11-30csaf · cert_bundDE

    Ein entfernter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Berechtigungen zu erweitern oder XSS-Angriffe durchzuführen.

05

also known as (1)

Other names and identifiers for this entity.

06

sources

Which sources assert this record, and when.

cnnvdcert_bundNVDCVE.orgMITRE
published 2023-12-01modified 2026-08-24
07

references (2) cnnvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan