Description
An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 12.8 – < 15.11.11, 16.0 – < 16.0.7, 16.1 – < 16.1.2 | 15.11.11 |
Advisories 1
- WID-SEC-2023-1667 GitLab: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jul 5, 2023
References
- GitLab Issue #416773 issue-tracking
- HackerOne Bug Bounty Report #2035687 technical-description exploit permissions-required