GoogleOSV:CVE-2023-5106CVE-2023-5106
8.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
6.8 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
18.0%
An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports.
| CPE | Name | Operator | Version |
|---|---|---|---|
| gitlab | eq | 10.5.0.pre | |
| gitlab | eq | 10.9.0.pre | |
| gitlab | eq | 11-10-119f9509d50-6d7537235-ee | |
| gitlab | eq | 7.4.0-ee | |
| gitlab | eq | 6.0.0-ee.rc1 | |
| gitlab | eq | 9.3.0.pre | |
| gitlab | eq | 3.0.3 | |
| gitlab | eq | 7.4.3-ee | |
| gitlab | eq | 8.4.0.rc1 | |
| gitlab | eq | 2.3.0 |
Related
8.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
6.8 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
18.0%