ANCHORE-2023-5933

ANCHORE-2023-5933 PUBLISHED

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.

Affected Products

Vendor	Product	Versions
GitLab	GitLab	16.8, 13.7, 16.7
GitLab	GitLab Enterprise	13.7, 16.7, 13.7

Timeline

Jan 25, 2024 CVE Published

References

https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ url
https://gitlab.com/gitlab-org/gitlab/-/issues/430236 url
https://hackerone.com/reports/2225710 url

Open in Interactive Console →