CVE-2023-4379: Incorrect Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.2.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.3.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.4.1
Event History
Frequently Asked Questions
What is CVE-2023-4379?
CVE-2023-4379 is a vulnerability in GitLab EE that allows improper access control.
Which versions of GitLab EE are affected by CVE-2023-4379?
All versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 are affected by CVE-2023-4379.
What is the severity of CVE-2023-4379?
CVE-2023-4379 has a severity rating of 8.1 (High).
How does CVE-2023-4379 work?
CVE-2023-4379 allows code owner approval to remain on merge requests even when the target branch is updated in GitLab EE.
Is there a fix available for CVE-2023-4379?
Yes, the fix is available in GitLab versions 16.2.8, 16.3.5, and 16.4.1.