CVE-2023-0450

2023-04-0500:00:00

GitLab

www.cve.org

gitlab

social engineering

ambiguous branch names

cve-2023-0450

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.6%

JSON

An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users.

CNA Affected

[
  {
    "vendor": "GitLab",
    "product": "GitLab",
    "versions": [
      {
        "version": ">=8.1, <15.8.5",
        "status": "affected"
      },
      {
        "version": ">=15.9, <15.9.4",
        "status": "affected"
      },
      {
        "version": ">=15.10, <15.10.1",
        "status": "affected"
      }
    ]
  }
]