CVE-2023-3920
Last modified
CVE-2023-3920 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation.. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 11.2, < 16.2.8 |
| Gitlab | Gitlab | >= 16.3.0, < 16.3.5 |
| Gitlab | Gitlab | 16.4.0 |
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/417481Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/2058121Permissions Required
- https://gitlab.com/gitlab-org/gitlab/-/issues/417481Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/2058121Permissions Required
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-3920?
How severe is CVE-2023-3920?
How do I fix CVE-2023-3920?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-39194A flaw was found in the XFRM subsystem in the Linux kernel. …4.4
- CVE-2023-39195Rejected reason: CVE-2023-39195 was found to be a duplicate …
- CVE-2023-39196Improper Authentication vulnerability in Apache Ozone. The …5.3
- CVE-2023-39197An out-of-bounds read vulnerability was found in Netfilter C…7.5
- CVE-2023-39198A race condition was found in the QXL driver in the Linux ke…6.4
- CVE-2023-39199Cryptographic issues with In-Meeting Chat for some Zoom clie…6.5
- CVE-2023-39201Untrusted search path in CleanZoom before file date 07/24/20…6.7
- CVE-2023-39202Untrusted search path in Zoom Rooms Client for Windows and Z…5.5
- CVE-2023-39203Uncontrolled resource consumption in Zoom Team Chat for Zoom…7.5
- CVE-2023-39204Buffer overflow in some Zoom clients may allow an unauthenti…7.5
- CVE-2023-39205Improper conditions check in Zoom Team Chat for Zoom clients…6.5
- CVE-2023-39206Buffer overflow in some Zoom clients may allow an unauthenti…7.5
Are you affected by CVE-2023-3920?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST