CVE-2023-6680: Smartcard authentication allows impersonation of arbitrary user using user’s public certificate
An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication. Smartcard authentication is an experimental feature and has to be manually enabled by an administrator.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6680?
The severity of CVE-2023-6680 is high due to the potential for an attacker to authenticate as another user.
How do I fix CVE-2023-6680?
To fix CVE-2023-6680, upgrade GitLab EE to versions 16.4.4, 16.5.4, or 16.6.2 or later.
Which versions of GitLab are affected by CVE-2023-6680?
CVE-2023-6680 affects all versions of GitLab EE from 11.6 to prior versions of 16.4.4, 16.5 to prior versions of 16.5.4, and 16.6 to prior versions of 16.6.2.
What type of vulnerability is CVE-2023-6680?
CVE-2023-6680 is an improper certificate validation issue specifically affecting Smartcard authentication.
What can an attacker do with CVE-2023-6680?
An attacker can authenticate as another user using their public key if they exploit the vulnerability in Smartcard authentication.