CVE-2023-2589
Last modified
CVE-2023-2589 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group.. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 12.0.0, < 15.10.8 |
| Gitlab | Gitlab | >= 15.11.0, < 15.11.7 |
| Gitlab | Gitlab | >= 16.0.0, < 16.0.2 |
References
- https://hackerone.com/reports/1941803Permissions Required, Third Party Advisory
- https://hackerone.com/reports/1941803Permissions Required, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-2589?
How severe is CVE-2023-2589?
How do I fix CVE-2023-2589?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-25884Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25885Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25886Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25887Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25888Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25889Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25890Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25891Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25892Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25893Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25894Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
- CVE-2023-25895Adobe Dimension versions 3.4.7 (and earlier) is affected by …7.8
Are you affected by CVE-2023-2589?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST