CVE-2023-1417
05.04.2023, 21:15
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | 15.9.0 ≤ 𝑥 < 15.9.4 |
| gitlab | gitlab | 15.9.0 ≤ 𝑥 < 15.9.4 |
| gitlab | gitlab | 15.10.0 |
| gitlab | gitlab | 15.10.0 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
References