CVE-2023-1417
Assigner: GitLab
Published: 2023-04-05T00:00:00
State: PUBLISHED
descriptions: value: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.
affected: vendor: GitLab
product: GitLab
versions: version: >=15.9, <15.9.4
status: affected
version: >=15.10, <15.10.1
status: affected
credits: value: Thanks [cryptopone](https://hackerone.com/cryptopone) for reporting this vulnerability through our HackerOne bug bounty program
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
problemTypes: descriptions: type: text
description: Authorization bypass through user-controlled key in GitLab