CVE-2023-2030

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-2030
An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/407252 Broken Link
https://hackerone.com/reports/1929929 Permissions Required
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.1:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.1:*:*:*:enterprise:*:*:*
History

18 Jan 2024, 21:18

Type Values Removed Values Added
References () https://gitlab.com/gitlab-org/gitlab/-/issues/407252 - () https://gitlab.com/gitlab-org/gitlab/-/issues/407252 - Broken Link
References () https://hackerone.com/reports/1929929 - () https://hackerone.com/reports/1929929 - Permissions Required
First Time Gitlab
Gitlab gitlab
CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.1:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.0:*:*:*:enterprise:*:*:*
Summary
  • (es) Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 12.2 anterior a 16.5.6, 16.6 anterior a 16.6.4 y 16.7 anterior a 16.7.2 en el que un atacante podría modificar los metadatos de las confirmaciones firmadas.
CVSS v2 : unknown
v3 : 3.5 		v2 : unknown
v3 : 5.3

12 Jan 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-12 14:15

Updated : 2024-01-18 21:18

NVD link : CVE-2023-2030

Mitre link : CVE-2023-2030

CVE.ORG link : CVE-2023-2030

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
CWE-345

Insufficient Verification of Data Authenticity