#VU76995 Permissions, Privileges, and Access Controls in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2023-2485
Published: June 6, 2023
Vulnerability identifier: #VU76995
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-2485
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Gitlab Community Edition
GitLab Enterprise Edition
Gitlab Community Edition
GitLab Enterprise Edition
Software vendor:
GitLab, Inc
GitLab, Inc
Description
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions. A remote administrator can escalate other users to Owners in the project if they import members from another project that those other users are Owners of.
Remediation
Install updates from vendor's website.