CVE-2023-6564

EPSS 0.02%
Published 08.02.2024 12:15:55
Last modified 21.11.2024 08:44:06
Source cve@gitlab.com
Teams watchlist Login
Open Login

An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Gitlab ≫ Gitlab Version16.4.3 SwEditionenterprise

Gitlab ≫ Gitlab Version16.5.3 SwEditionenterprise

Gitlab ≫ Gitlab Version16.6.1 SwEditionenterprise

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.02%	0.035

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
cve@gitlab.com	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://gitlab.com/gitlab-com/gl-infra/production/-/issues/17213

Issue Tracking

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2023-6564

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-6564

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-6564

EUVD