CVE-2023-4658
Assigner: GitLab
Published: 2023-12-01T07:01:58.125Z
State: PUBLISHED
title: Improper Access Control in GitLab
descriptions: value: An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.
affected: vendor: GitLab
product: GitLab
repo: git://git@gitlab.com:gitlab-org/gitlab.git
versions: version: 8.13
status: affected
lessThan: 16.4.3
versionType: semver
version: 16.5
status: affected
lessThan: 16.5.3
versionType: semver
version: 16.6
status: affected
lessThan: 16.6.1
versionType: semver
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-284: Improper Access Control
cweId: CWE-284
type: CWE
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
solutions: value: Upgrade to versions 16.4.3, 16.5.3, 16.6.1 or above.
credits: value: Thanks [theluci](https://hackerone.com/theluci) for reporting this vulnerability through our HackerOne bug bounty program
type: finder