CVE-2023-6564

2024-02-0800:00:00

ubuntu.com

cve-2023-6564

gitlab

subgroup permissions

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

16.0%

JSON

An issue has been discovered in GitLab EE Premium and Ultimate affecting
versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define
who can push and/or merge to protected branches, there may have been
instances in which subgroup members with the Developer role were able to
push or merge to protected branches.