CVE-2023-2022: Missing Authorization in GitLab
First published: Wed Aug 02 2023(Updated: )
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge
Credit: cve@gitlab.com cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab GitLab | <16.0.8 | |
| GitLab GitLab | <16.0.8 | |
| GitLab GitLab | >=16.1<16.1.3 | |
| GitLab GitLab | >=16.1<16.1.3 | |
| GitLab GitLab | >=16.2<16.2.2 | |
| GitLab GitLab | >=16.2<16.2.2 |
Remedy
Upgrade to versions 16.2.2, 16.1.3, 16.0.8 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue in GitLab CE/EE?
The vulnerability ID of this issue in GitLab CE/EE is CVE-2023-2022.
What is the severity rating of CVE-2023-2022 in GitLab CE/EE?
The severity rating of CVE-2023-2022 in GitLab CE/EE is 4.3 (medium).
Which versions of GitLab CE/EE are affected by CVE-2023-2022?
All versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2 of GitLab CE/EE are affected by CVE-2023-2022.
What is the impact of CVE-2023-2022 in GitLab CE/EE?
CVE-2023-2022 allows developers to create pipeline schedules on protected branches even if they don't have access, potentially leading to unauthorized access or privilege escalation.
Are there any references for more information about CVE-2023-2022 in GitLab CE/EE?
Yes, you can find more information about CVE-2023-2022 in GitLab CE/EE at the following links: [Link 1](https://gitlab.com/gitlab-org/gitlab/-/issues/407166), [Link 2](https://hackerone.com/reports/1936572).
- agent/references
- agent/author
- agent/type
- collector/nvd-latest
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/severity
- agent/softwarecombine
- agent/description
- agent/remedy
- agent/first-publish-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/title
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/gitlab
- canonical/gitlab gitlab
- version/gitlab gitlab/16.2
- version/gitlab gitlab/16.1