Vulnerability identifier: #VU84413
Vulnerability risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-284
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
GitLab Enterprise Edition
Universal components / Libraries /
Software for developers
Vendor: GitLab, Inc
Description
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to in projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
GitLab Enterprise Edition: 16.4.3 - 16.6.1
External links
http://about.gitlab.com/releases/2023/12/13/security-release-gitlab-16-6-2-released/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.