CVE-2023-3964 — Incorrect Authorization in GitLab

Description (CNA)

An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 13.2 before 16.4.3; affected 16.5 before 16.5.3; affected 16.6 before 16.6.1

CWE

CWE-863

References

https://gitlab.com/gitlab-org/gitlab/-/issues/419857
https://hackerone.com/reports/2037316

ADP enrichment

CVE

No English description supplied.

https://gitlab.com/gitlab-org/gitlab/-/issues/419857
https://hackerone.com/reports/2037316

CISA-ADP

No English description supplied.

No references supplied.