CVE Vulnerabilities

CVE-2023-6477

Incorrect Privilege Assignment

Published: Feb 22, 2024 | Modified: Nov 21, 2024
CVSS 3.x
6.7
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member permission, they may be able to make a group, other members or themselves Owners of that group, which may lead to privilege escalation.

Weakness

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Gitlab Gitlab 16.5.0 (including) 16.7.6 (excluding)
Gitlab Gitlab 16.8.0 (including) 16.8.3 (including)
Gitlab Gitlab 16.9.0 (including) 16.9.0 (including)
Gitlab Ubuntu esm-apps/xenial *
Gitlab Ubuntu xenial *

Potential Mitigations

References