CVE-2023-5198 — Incorrect Authorization in GitLab

CVE-2023-5198

Incorrect Authorization in GitLab PUBLISHED

Description (CNA)

An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 0 through 16.2.7; affected 16.3 before 16.3.5; affected 16.4 before 16.4.1

CWE

CWE-863

References

https://gitlab.com/gitlab-org/gitlab/-/issues/416957
https://hackerone.com/reports/2041789

ADP enrichment

CVE

No English description supplied.

https://gitlab.com/gitlab-org/gitlab/-/issues/416957
https://hackerone.com/reports/2041789

CISA-ADP

No English description supplied.

No references supplied.