Vulnerability Description
A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 16.0.0, < 16.2.8 |
Related Weaknesses (CWE)
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/425604Broken Link
- https://gitlab.com/gitlab-org/gitlab/-/issues/425857Broken Link
- https://hackerone.com/reports/2174141Permissions Required
- https://gitlab.com/gitlab-org/gitlab/-/issues/425604Broken Link
- https://gitlab.com/gitlab-org/gitlab/-/issues/425857Broken Link
- https://hackerone.com/reports/2174141Permissions Required
FAQ
What is CVE-2023-5207?
CVE-2023-5207 is a vulnerability with a CVSS score of 8.2 (HIGH). A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitra...
How severe is CVE-2023-5207?
CVE-2023-5207 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-5207?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab.