4.3med
CVE-2023-2001
An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all ve…
Published 3 y ago · modified 4 mo ago · JSON
CVSS
4.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 48%
Public exploits
0
none known
Summary
An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction (EPSS)
0.58% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Affected products
- GitLab GitLab
Classification
- Weakness
- CWE-290 Authentication Bypass by Spoofing
- Technology feeds
- GitLab (RSS, critical only)
References
- gitlab.com /gitlab-org/gitlab/-/issues/406764 · x_transferred, exploit
- hackerone.com /reports/1908423 · x_transferred
- gitlab.com /gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json · x_transferred
Sources
- CVE List: CVE-2023-2001
- NVD: CVE-2023-2001
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.