CVE-2023-2022: Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue in GitLab CE/EE?
The vulnerability ID of this issue in GitLab CE/EE is CVE-2023-2022.
What is the severity rating of CVE-2023-2022 in GitLab CE/EE?
The severity rating of CVE-2023-2022 in GitLab CE/EE is 4.3 (medium).
Which versions of GitLab CE/EE are affected by CVE-2023-2022?
All versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2 of GitLab CE/EE are affected by CVE-2023-2022.
What is the impact of CVE-2023-2022 in GitLab CE/EE?
CVE-2023-2022 allows developers to create pipeline schedules on protected branches even if they don't have access, potentially leading to unauthorized access or privilege escalation.
Are there any references for more information about CVE-2023-2022 in GitLab CE/EE?
Yes, you can find more information about CVE-2023-2022 in GitLab CE/EE at the following links: [Link 1](https://gitlab.com/gitlab-org/gitlab/-/issues/407166), [Link 2](https://hackerone.com/reports/1936572).