p PatchFirst

CVE-2023-5207

CVE-2023-5207 · Execution with Unnecessary Privileges in GitLab

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user.

CVSS 8.2 · High · EPSS 1.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • gitlab

    Versions
    • ≥ 16.4, < 16.4.1: Affected (semver)
    • ≥ 16.3, < 16.3.5: Affected (semver)
    • ≥ 16.0.0, < 16.2.8: Affected (semver)

    Update to 16.2.8; Update to 16.3.5; Update to 16.4.1

  • gitlab Ubuntu:16.04:LTS

    Versions
    • 8.4.3+dfsg-9
    • 8.4.3+dfsg-12
    • 8.5.8+dfsg-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →