CVE-2023-5207

    Dashboard / Vulnerabilities / CVE-2023-5207

    CVE-2023-5207

    Published: 30 Sept 2023Last Modified: 11 Sept 2026

    Summary: Execution with Unnecessary Privileges in GitLab

    Details: A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5207.json, https://nvd.nist.gov/vuln/detail/CVE-2023-5207, https://gitlab.com/gitlab-org/gitlab/-/issues/425604, https://gitlab.com/gitlab-org/gitlab/-/issues/425857, https://hackerone.com/reports/2174141, git://[email protected]:gitlab-org/gitlab.git

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e4c1c182610739c1b1d10a8eacbea1f5aa837ad6
    Fixed -229bc5f59850b16213b035138ad76f65b6724864

    Affected versions

    v16.4.0-ee

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-5207 | CVE-DB