CVSS: 7.6EPSS: 0%CPEs: 6EXPL: 1CVE-2023-4812 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-4812
An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request. Se descubrió un problema en GitLab EE que afecta a todas las versiones desde 15.3 anteriores a 16.5.6, todas las versiones desde 16.6 anteriores a 16.6.4, todas las versiones desde 16.7 anteriores a 16.7.2. La aprobación requerida de CODEOWNERS podría omitirse agregando cambios a una solicitud de fusión previamente aprobada. • https://gitlab.com/gitlab-org/gitlab/-/issues/424398 https://hackerone.com/reports/2115574 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 1CVE-2023-5356 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-5356
Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user. Verificaciones de autorización incorrectas en GitLab CE/EE desde todas las versiones desde 8.13 anteriores a 16.5.6, todas las versiones desde 16.6 anteriores a 16.6.4, todas las versiones desde 16.7 anteriores a 16.7.2, permiten que un usuario abuse de las integraciones de slack/mattermost para ejecutar slash commands como otro usuario. • https://gitlab.com/gitlab-org/gitlab/-/issues/427154 https://hackerone.com/reports/2188868 • CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 91%CPEs: 14EXPL: 16CVE-2023-7028 – GitLab Community and Enterprise Editions Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2023-7028
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 16.1 anterior a 16.1.6, 16.2 anterior a 16.2.9, 16.3 anterior a 16.3.7, 16.4 anterior a 16.4.5, 16.5 anterior a 16.5.6, 16.6 antes de 16.6.4 y 16.7 antes de 16.7.2 en los que los correos electrónicos de restablecimiento de contraseña de cuenta de usuario podían enviarse a una dirección de correo electrónico no verificada. GitLab CE/EE versions prior to 16.7.2 suffer from a password reset vulnerability. GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. • https://www.exploit-db.com/exploits/51889 https://github.com/yoryio/CVE-2023-7028 https://github.com/mochammadrafi/CVE-2023-7028 https://github.com/soltanali0/CVE-2023-7028 https://github.com/Vozec/CVE-2023-7028 https://github.com/RandomRobbieBF/CVE-2023-7028 https://github.com/duy-31/CVE-2023-7028 https://github.com/thanhlam-attt/CVE-2023-7028 https://github.com/googlei1996/CVE-2023-7028 https://github.com/Trackflaw/CVE-2023-7028-Docker https://github.com/Shim • CWE-284: Improper Access Control CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 6.6EPSS: 0%CPEs: 8EXPL: 0CVE-2023-6955 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-6955
An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group. Existe una vulnerabilidad de control de acceso inadecuado en GitLab Remote Development que afecta a todas las versiones anteriores a 16.5.6, 16.6 anterior a 16.6.4 y 16.7 anterior a 16.7.2. Esta condición permite a un atacante crear un workspace en un grupo asociado con un agente de otro grupo. A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. • https://gitlab.com/gitlab-org/gitlab/-/issues/432188 • CWE-284: Improper Access Control CWE-668: Exposure of Resource to Wrong Sphere CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3907 – Improper User Management in GitLab
https://notcve.org/view.php?id=CVE-2023-3907
A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner Una vulnerabilidad de escalada de privilegios en GitLab EE que afecta a todas las versiones desde 16.0 anterior a 16.4.4, 16.5 anterior a 16.5.4 y 16.6 anterior a 16.6.2 permite que un mantenedor de proyecto use un token de acceso al proyecto para escalar su rol a propietario. • https://gitlab.com/gitlab-org/gitlab/-/issues/418878 https://hackerone.com/reports/2058934 • CWE-269: Improper Privilege Management CWE-286: Incorrect User Management •