Permissions, Privileges, and Access Controls in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2023-2485

 

Permissions, Privileges, and Access Controls in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2023-2485

Published: June 6, 2023


Vulnerability identifier: #VU76995
CSH Severity: Low
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-2485
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions. A remote administrator can escalate other users to Owners in the project if they import members from another project that those other users are Owners of.


Affected software

GitLab Enterprise Edition
Gitlab Community Edition

How to mitigate CVE-2023-2485

Install updates from vendor's website.

GitLab Enterprise Edition - addressed in versions 15.10.8, 15.11.7, 16.0.2
Gitlab Community Edition - addressed in versions 15.10.8, 15.11.7, 16.0.2

External References

Related Security Bulletins