CVE-2023-2182

Опубликовано: 03 мая 2023

Источник: nvd

CVSS3: 6.8

CVSS3: 8.8

EPSS Низкий

Описание

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users.

Ссылки

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2182.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/403012
Exploit
Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2182.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/403012
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Версия от 15.10.0 (включая) до 15.10.5 (исключая)

cpe:2.3:a:gitlab:gitlab:15.11.0:*:*:*:enterprise:*:*:*

EPSS

Процентиль: 60%

0.00401

Низкий

6.8 Medium

CVSS3

8.8 High

CVSS3

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2023-2182

CVSS3: 6.8

debian

почти 3 года назад

An issue has been discovered in GitLab EE affecting all versions start ...

GHSA-j24v-67h6-cx49

CVSS3: 6.8

github

почти 3 года назад

EPSS

Процентиль: 60%

0.00401

Низкий

6.8 Medium

CVSS3

8.8 High

CVSS3

Дефекты

NVD-CWE-noinfo