p PatchFirst

CVE-2023-6955

CVE-2023-6955 · Missing Authorization in GitLab

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.

CVSS 6.6 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • gitlab

    Versions
    • ≥ 0, < 16.5.6: Affected (semver)
    • ≥ 16.6, < 16.6.4: Affected (semver)
    • ≥ 16.7, < 16.7.2: Affected (semver)

    Update to 16.5.6; Update to 16.6.4; Update to 16.7.2

  • gitlab Ubuntu:16.04:LTS

    Versions
    • 8.4.3+dfsg-9
    • 8.4.3+dfsg-12
    • 8.5.8+dfsg-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →