CVE-2023-4630: Missing Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.1.5 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.2.5 - Upgrade
Upgrade
GitLabto a version that resolves this vulnerability.Fixed in 16.3.1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-4630.
What is the severity of CVE-2023-4630?
The severity of CVE-2023-4630 is medium with a severity value of 4.3.
Which versions of GitLab are affected by CVE-2023-4630?
All versions starting from 10.6 to 16.1.5, all versions starting from 16.2 to 16.2.5, and version 16.3.0 are affected by CVE-2023-4630.
What is the impact of CVE-2023-4630?
CVE-2023-4630 allows any user to read limited information about any project's imports in GitLab.
Are there any references for CVE-2023-4630?
Yes, you can find references for CVE-2023-4630 at the following links: [Reference 1](https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released/) and [Reference 2](https://gitlab.com/gitlab-org/gitlab/-/issues/415117).