An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/408137 | Broken Link Vendor Advisory |
| https://hackerone.com/reports/1944500 | Third Party Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/408137 | Broken Link Vendor Advisory |
| https://hackerone.com/reports/1944500 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/408137 - Broken Link, Vendor Advisory | |
| References | () https://hackerone.com/reports/1944500 - Third Party Advisory |
20 Jul 2023, 20:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://hackerone.com/reports/1944500 - Third Party Advisory | |
| References | (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/408137 - Broken Link, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-639 | |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
13 Jul 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-13 02:15
Updated : 2024-11-21 07:58
NVD link : CVE-2023-2190
Mitre link : CVE-2023-2190
CVE.ORG link : CVE-2023-2190
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-639
Authorization Bypass Through User-Controlled Key