CVE-2023-4379

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/415496	Issue Tracking
https://gitlab.com/gitlab-org/gitlab/-/issues/415496	Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:16.4.0::::enterprise:::

History

21 Nov 2024, 08:34

Type	Values Removed	Values Added
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/415496 - Issue Tracking~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/415496 - Issue Tracking
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 8.1

03 Oct 2024, 07:15

Type	Values Removed	Values Added
CWE	~~CWE-284~~	CWE-863

16 Nov 2023, 19:24

Type	Values Removed	Values Added
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:16.4.0::::enterprise:::
First Time		Gitlab Gitlab gitlab
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/415496 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/415496 - Issue Tracking

09 Nov 2023, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-09 21:15

Updated : 2024-11-21 08:34

NVD link : CVE-2023-4379

Mitre link : CVE-2023-4379

CVE.ORG link : CVE-2023-4379

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-863

Incorrect Authorization

NVD-CWE-noinfo

{"id": "CVE-2023-4379", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-11-09T21:15:24.930", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/415496", "tags": ["Issue Tracking"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/415496", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en GitLab EE que afecta a todas las versiones desde la 15.3 anterior a la 16.2.8, la 16.3 anterior a la 16.3.5 y la 16.4 anterior a la 16.4.1. La aprobaci\u00f3n del propietario del c\u00f3digo no se elimin\u00f3 de las solicitudes de fusi\u00f3n cuando se actualiz\u00f3 la rama de destino."}], "lastModified": "2024-11-21T08:34:58.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "863E98A5-7F1C-4CFA-A209-19E66F04A718", "versionEndExcluding": "16.2.8", "versionStartIncluding": "15.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "CC5696C9-592A-4D50-B5BB-9A250DAB6589", "versionEndExcluding": "16.3.5", "versionStartIncluding": "16.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:16.4.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "6696C987-61C1-462E-8A73-016F9902BC67"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}