CVE-2023-3915
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An issue has been discovered in GitLab EE affecting all versions from 16.1 to 16.1.5, from 16.2 to 16.2.5, and from 16.3 to 16.3.1. An external user with an owner role in a group may escalate their privileges by creating a service account in that group.
Risk Assessment
The risk is that external users may gain access to internal projects, potentially leading to unauthorized access to sensitive data.
Recommendation
It is recommended to update GitLab EE to the latest version to mitigate the risk associated with this vulnerability and to limit assigning owner roles to external users.
Original NVD description (English source)
An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access internal projects.