An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gitlab |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-54510 | An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group. |
Fixes
Solution
Upgrade to versions 16.4.3, 16.5.3, 16.6.1 or above.
Workaround
No workaround given by the vendor.
References
History
Thu, 03 Oct 2024 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 |
Thu, 03 Oct 2024 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Improper Access Control in GitLab | Incorrect Authorization in GitLab |
| Weaknesses | CWE-863 |
Thu, 29 Aug 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* |
MITRE
Status: PUBLISHED
Assigner: GitLab
Published:
Updated: 2025-05-22T04:08:36.311Z
Reserved: 2023-08-31T05:30:28.470Z
Link: CVE-2023-4658
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-12-01T07:15:10.807
Modified: 2024-11-21T08:35:37.680
Link: CVE-2023-4658
Redhat
No data.
OpenCVE Enrichment
No data.