GHSA-84m5-rqxq-483p

GHSA-84m5-rqxq-483p PUBLISHED CVSS 6.400000095367432 MEDIUM

Record from GitHub Advisory Database · Published January 26, 2024

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.

Risk scores

CVSS 3.1

6.400000095367432

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Timeline

Jan 26, 2024 CVE Published
Apr 10, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-84m5-rqxq-483p
vulnetix vdb fixes GHSA-84m5-rqxq-483p

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-84m5-rqxq-483p/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://gitlab.com/gitlab-org/gitlab/-/issues/430236 url
https://nvd.nist.gov/vuln/detail/CVE-2023-5933 advisory
https://hackerone.com/reports/2225710 url
https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released url

Look up in the Resolve Platform →