Loading vulnerability…
Incorrect Authorization in GitLab Composer Package Registry
CVE-2023-3964 is a medium-severity authorization vulnerability in GitLab (CE/EE), affecting versions from 13.2 up to but not including 16.4.3, 16.5 up to 16.5.3, and 16.6 up to 16.6.1. The flaw allows users to access composer packages on public projects even when the package registry is disabled in the project settings, due to improper authorization checks (CWE-863). The vulnerability is exploitable over the network, requires low privileges, and does not require user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation allows unauthorized users to access composer packages from public projects where the package registry is intended to be disabled, resulting in partial loss of confidentiality. There is no impact on integrity or availability. The vulnerability could potentially expose sensitive or proprietary package data that project maintainers intended to restrict.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict network access to the GitLab instance or disable public project visibility as a temporary measure. However, the only complete mitigation is to upgrade to a fixed version.
Patch, then assume compromise.
Upgrade GitLab to version 16.4.3, 16.5.3, or 16.6.1 or later, where the authorization logic for composer package access has been corrected. No other mitigations are provided by the vendor.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.