CVE-2023-5356

2024-01-1200:00:00

ubuntu.com

gitlab

authorization check

slash commands

cve-2023-5356

mattermost integration

unix

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

0.001

Percentile

29.9%

JSON

Incorrect authorization checks in GitLab CE/EE from all versions starting
from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all
versions starting from 16.7 before 16.7.2, allows a user to abuse
slack/mattermost integrations to execute slash commands as another user.