PT-2023-26773

CVE-2023-3907

Publicado

2023-12-17

Atualizado

2024-10-08

Descrição por

CVSS 3.1

4.9

Média

MétricasAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.0 through 16.4.3 GitLab EE versions 16.5 through 16.5.3 GitLab EE versions 16.6 through 16.6.1

Description A privilege escalation issue in GitLab EE allows a project Maintainer to use a Project Access Token to escalate their role to Owner.

Recommendations For versions 16.0 through 16.4.3, update to version 16.4.4 or later. For versions 16.5 through 16.5.3, update to version 16.5.4 or later. For versions 16.6 through 16.6.1, update to version 16.6.2 or later.

Explorabilidade

Exploit

Correção

Pesquisadores

Ashish

Ashish_R_Padelkar

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-286: Incorrect User Management

Identificadores relacionados

CVE-2023-3907