CVE-2023-3484: Incorrect Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.11.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3484?
The severity of CVE-2023-3484 is high.
What versions of GitLab EE are affected by CVE-2023-3484?
All versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, and all versions starting from 16.1 before 16.1.2 of GitLab EE are affected.
What is the vulnerability in CVE-2023-3484?
The vulnerability in CVE-2023-3484 allows an attacker to change the name or path of a public top-level group in certain situations.
Are there any references for CVE-2023-3484?
Yes, you can find references for CVE-2023-3484 at the following links: [link1](https://hackerone.com/reports/2035687), [link2](https://gitlab.com/gitlab-org/gitlab/-/issues/416773), [link3](https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released/)
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-3484?
The CWE ID for CVE-2023-3484 is 840.