CVE-2023-6564

EPSS 0.02%
Veröffentlicht 08.02.2024 12:15:55
Zuletzt bearbeitet 21.11.2024 08:44:06
Quelle cve@gitlab.com
Teams Watchlist Login
Unerledigt Login

An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Gitlab ≫ Gitlab Version16.4.3 SwEditionenterprise

Gitlab ≫ Gitlab Version16.5.3 SwEditionenterprise

Gitlab ≫ Gitlab Version16.6.1 SwEditionenterprise

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.02%	0.035

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
cve@gitlab.com	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://gitlab.com/gitlab-com/gl-infra/production/-/issues/17213

Issue Tracking

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2023-6564

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-6564

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-6564

EUVD