CVE-2023-5009CWE-863

Incorrect Authorization in GitLab

Critical · published September 19, 2023

CVSS v3.1

9.6

EPSS

10%

Percentile

95.5

In the wild

Unconfirmed

What it is

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact.

The record

Technical detail

CVSS v3.1: 9.6 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.09651 · 95.5th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2023-09-19T07:01Z

EPSS history

Timeline

19 SEP 07:01Z
Incorrect Authorization in GitLab
cvelistv5