CVE-2023-6840: Project maintainers can bypass group’s scan result policy block_branch_modification setting
An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6840?
CVE-2023-6840 is classified as a medium severity vulnerability.
What versions of GitLab EE are affected by CVE-2023-6840?
CVE-2023-6840 affects GitLab EE versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2.
How do I fix CVE-2023-6840?
To fix CVE-2023-6840, upgrade to GitLab EE versions 16.6.7, 16.7.5, or 16.8.2 or newer.
What is the impact of CVE-2023-6840?
CVE-2023-6840 allows a maintainer to change the name of a protected branch, bypassing existing security policies.
Who can exploit CVE-2023-6840?
CVE-2023-6840 can be exploited by any maintainer with access to the protected branch in the affected GitLab EE versions.