CVE-2023-2190
Assigner: GitLab
Published: 2023-07-13T02:00:02.797Z
State: PUBLISHED
title: Authorization Bypass Through User-Controlled Key in GitLab
descriptions: value: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.
affected: vendor: GitLab
product: GitLab
repo: git://git@gitlab.com:gitlab-org/gitlab.git
versions: version: 13.10
status: affected
lessThan: 15.11.10
versionType: semver
version: 16.0
status: affected
lessThan: 16.0.6
versionType: semver
version: 16.1
status: affected
lessThan: 16.1.1
versionType: semver
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-639: Authorization Bypass Through User-Controlled Key
cweId: CWE-639
type: CWE
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
solutions: value: Upgrade to versions 16.1.1, 16.0.6, 15.11.10 or above.
credits: value: Thanks [pwnie](https://hackerone.com/pwnie) for reporting this vulnerability through our HackerOne bug bounty program
type: finder