Lucene search

PRIOn knowledge basePRION:CVE-2023-6840

HistoryFeb 07, 2024 - 10:15 p.m.

Code injection

2024-02-0722:15:00

PRIOn knowledge base

www.prio-n.com

gitlab

security issue

code injection

vulnerability

version 16.x

maintainer

protected branch

security policy

6.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

6.8 Medium

AI Score

Confidence

Low

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

15.6%

JSON

An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR.

CPENameOperatorVersion
gitlabge16.7.0
gitlablt16.7.5
gitlabge16.8.0
gitlablt16.8.2
gitlabge16.4.0
gitlablt16.6.7

Name	Operator	Version
gitlab	ge	16.7.0
gitlab	lt	16.7.5
gitlab	ge	16.8.0
gitlab	lt	16.8.2
gitlab	ge	16.4.0
gitlab	lt	16.6.7

References

gitlab.com/gitlab-org/gitlab/-/issues/435500

hackerone.com/reports/2280292

6.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

6.8 Medium

AI Score

Confidence

Low

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

15.6%

JSON

Related for PRION:CVE-2023-6840