CVE-2023-2478: Critical severity gitlab vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2478?
CVE-2023-2478 is classified as a high severity vulnerability.
How do I fix CVE-2023-2478?
To fix CVE-2023-2478, upgrade GitLab to the latest version above 15.9.7, 15.10.6, or 15.11.2, depending on your current version.
Who is affected by CVE-2023-2478?
CVE-2023-2478 affects all GitLab Community and Enterprise Edition versions from 15.4 up to 15.9.7, from 15.10 up to 15.10.6, and from 15.11 up to 15.11.2.
What impacts does CVE-2023-2478 have on GitLab?
CVE-2023-2478 could allow a malicious unauthorized user to exploit a GraphQL endpoint under specific conditions.
How can I determine if I am vulnerable to CVE-2023-2478?
You can determine your vulnerability to CVE-2023-2478 by checking if you are running a version of GitLab that falls within the affected version range.