GitLab patches multiple flaws including XSS and GitLab EE authorization bypass
Patch & Detection Intelligence · 2 sources · Updated 3mo ago · First seen Dec 1, 2023
GitLab released security updates for Community Edition and Enterprise Edition in versions 16.6.1, 16.5.3, and 16.4.3, urging affected self-managed installations to upgrade immediately. The fixes addressed multiple vulnerabilities spanning XSS, privilege escalation, information disclosure, authorization bypass, package registry access issues, protected branch and pipeline schedule permission bypasses, and client-side denial of service. The most severe issue was CVE-2023-6033, a high-severity cross-site scripting flaw in Jira integration configuration, while GitLab said GitLab.com was already running the patched version.
One of the patched Enterprise Edition issues, CVE-2023-4658, was an incorrect authorization flaw that allowed a guest user to abuse the "Allowed to merge" permission when that right was inherited through a group. GitLab rated that bug CVSS 3.1 / Low and said it affected versions from 8.13 before 16.4.3, 16.5 before 16.5.3, and 16.6 before 16.6.1. The release also included fixes for unauthorized access to release descriptions and other EE-specific authorization weaknesses, along with bundled component updates for Mattermost, PostgreSQL, and pcre2.
