CVE-2023-3932: Incorrect User Management in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this GitLab EE issue?
The vulnerability ID for this GitLab EE issue is CVE-2023-3932.
Which versions of GitLab EE are affected by this vulnerability?
All versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2 are affected by this vulnerability.
What is the severity of CVE-2023-3932?
The severity of CVE-2023-3932 is high with a CVSS score of 6.5.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by running pipeline jobs as an arbitrary user via scheduled security scan policies.
Are there any references available for this vulnerability?
Yes, you can find references for this vulnerability at the following links: [GitLab Issue](https://gitlab.com/gitlab-org/gitlab/-/issues/417594) and [HackerOne Report](https://hackerone.com/reports/2057633).