CVE-2023-3914CWE-286

Incorrect User Management in GitLab

Medium · published September 29, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-286 · Incorrect User Management
Published
2023-09-29T06:02Z
EPSS history
Timeline
  • 29 SEP 06:02Z
    Incorrect User Management in GitLab
    cvelistv5