CVE-2023-4008: Incorrect Ownership Assignment in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-4008?
CVE-2023-4008 is an issue discovered in GitLab CE/EE that allows for takeover of GitLab Pages with unique domain URLs if the random string added is known.
Which versions of GitLab are affected by CVE-2023-4008?
All versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2 are affected.
How severe is CVE-2023-4008?
CVE-2023-4008 has a severity rating of 9.8 (Critical).
How can I fix CVE-2023-4008?
To fix CVE-2023-4008, update your GitLab CE/EE to version 16.0.8, 16.1.3, or 16.2.2 or later.
Where can I find more information about CVE-2023-4008?
You can find more information about CVE-2023-4008 on the GitLab issue page: https://gitlab.com/gitlab-org/gitlab/-/issues/415942