CVE-2023-5009: Incorrect Authorization in GitLab

Published Sep 19, 2023
·
Updated

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of CVE-2023-3932 showing additional impact.

Affected Software

2 affected components
GitLab GitLab>=13.12<16.2.7
GitLab GitLab>=16.3<16.3.4

Remediation

Information

Upgrade to versions 16.2.7, 16.3.4 or above For those users unable to upgrade for those versions, you can mitigate the vulnerability by having at most one of those two features turned on at one time: - [Direct transfers](https://docs.gitlab.com/ee/administration/settings/import_and_export_settings.html#enable-migration-of-groups-and-projects-by-direct-transfer) - [Security policies](https://docs.gitlab.com/ee/user/application_security/policies/scan-execution-policies.html)

Event History

Sep 19, 2023
CVE Published
via MITRE·07:01 AM
Data Sourced
via MITRE·07:01 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:16 AM
DescriptionSeverityWeaknessAffected Software
Sep 12, 2024
News Published
via BleepingComputer·02:50 PM
News Published
via BleepingComputer·02:51 PM

Frequently Asked Questions

1

What is CVE-2023-5009?

CVE-2023-5009 is a vulnerability discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7.

2

What is the severity of CVE-2023-5009?

CVE-2023-5009 has a severity rating of 9.6, which is classified as critical.

3

How does CVE-2023-5009 impact GitLab EE?

CVE-2023-5009 allows an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.

4

How can I check if my GitLab EE version is affected by CVE-2023-5009?

If your GitLab EE version is between 13.12 and 16.2.7, or between 16.3 and 16.3.4, it is affected by CVE-2023-5009.

5

How can I mitigate CVE-2023-5009 in GitLab EE?

To mitigate CVE-2023-5009, you should update to GitLab EE version 16.2.7 or higher, or version 16.3.4 or higher.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203