CVE-2023-3914 Business Logic Errors in GitLab

2023-09-2906:02:21

CWE-840

GitLab

github.com

gitlab

business logic errors

cve-2023-3914

internal projects

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

20.2%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
    ],
    "vendor": "gitlab",
    "product": "gitlab",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "16.2.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:a:gitlab:gitlab:16.3.0:*:*:*:enterprise:*:*:*"
    ],
    "vendor": "gitlab",
    "product": "gitlab",
    "versions": [
      {
        "status": "affected",
        "version": "16.3.0",
        "lessThan": "16.3.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:a:gitlab:gitlab:16.4.0:*:*:*:enterprise:*:*:*"
    ],
    "vendor": "gitlab",
    "product": "gitlab",
    "versions": [
      {
        "status": "affected",
        "version": "16.4.0",
        "lessThan": "16.4.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]