CVE-2023-3914: Incorrect User Management in GitLab
A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.2.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.3.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3914?
The severity of CVE-2023-3914 is medium with a CVSS score of 5.4.
Which versions of GitLab EE are affected by CVE-2023-3914?
All versions of GitLab EE prior to 16.2.8, 16.3.0 to 16.3.5, and version 16.4.0 are affected by CVE-2023-3914.
What is the impact of CVE-2023-3914?
CVE-2023-3914 allows unauthorized access to internal projects in GitLab EE.
How can I fix CVE-2023-3914?
To fix CVE-2023-3914, update GitLab EE to version 16.2.8, 16.3.5, or 16.4.1.
Where can I find more information about CVE-2023-3914?
More information about CVE-2023-3914 can be found at the following references: - [GitLab Issue 418115](https://gitlab.com/gitlab-org/gitlab/-/issues/418115) - [HackerOne Report 2040822](https://hackerone.com/reports/2040822)