CVE-2023-4008: Incorrect Ownership Assignment in GitLab
First published: Thu Aug 03 2023(Updated: )
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known.
Credit: cve@gitlab.com cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab GitLab | >=15.9.0<16.0.8 | |
| GitLab GitLab | >=15.9.0<16.0.8 | |
| GitLab GitLab | >=16.1<16.1.3 | |
| GitLab GitLab | >=16.1<16.1.3 | |
| GitLab GitLab | >=16.2<16.2.2 | |
| GitLab GitLab | >=16.2<16.2.2 | |
| >=15.9.0<16.0.8 | ||
| >=15.9.0<16.0.8 | ||
| >=16.1<16.1.3 | ||
| >=16.1<16.1.3 | ||
| >=16.2<16.2.2 | ||
| >=16.2<16.2.2 |
Remedy
Upgrade to versions 16.2.2, 16.1.3, 16.0.8 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-4008?
CVE-2023-4008 is an issue discovered in GitLab CE/EE that allows for takeover of GitLab Pages with unique domain URLs if the random string added is known.
Which versions of GitLab are affected by CVE-2023-4008?
All versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2 are affected.
How severe is CVE-2023-4008?
CVE-2023-4008 has a severity rating of 9.8 (Critical).
How can I fix CVE-2023-4008?
To fix CVE-2023-4008, update your GitLab CE/EE to version 16.0.8, 16.1.3, or 16.2.2 or later.
Where can I find more information about CVE-2023-4008?
You can find more information about CVE-2023-4008 on the GitLab issue page: https://gitlab.com/gitlab-org/gitlab/-/issues/415942
- collector/nvd-latest
- agent/author
- agent/type
- collector/epss-latest
- source/FIRST
- agent/references
- agent/description
- agent/epss
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/severity
- agent/remedy
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/gitlab
- canonical/gitlab gitlab
- version/gitlab gitlab/15.9.0
- version/gitlab gitlab/16.1
- version/gitlab gitlab/16.2