CVE-2023-2182

EUVD-2023-33699
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
GitLabCNA
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
Affected Products (NVD)
VendorProductVersion
gitlabgitlab
15.10.0 ≤
𝑥
< 15.10.5
gitlabgitlab
15.11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gitlab
sid
16.8.4-1
fixed
References
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2182.json
https://gitlab.com/gitlab-org/gitlab/-/issues/403012
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2182.json
https://gitlab.com/gitlab-org/gitlab/-/issues/403012