Loading vulnerability…
Privilege Escalation via Policy Bot in GitLab EE
CVE-2023-5995 is a privilege escalation vulnerability in GitLab EE affecting versions 16.2 before 16.4.3, 16.5 before 16.5.3, and 16.6 before 16.6.1. The vulnerability allows an attacker to abuse the policy bot feature to gain unauthorized access to internal projects, bypassing intended access controls.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to access internal projects that should be restricted, potentially exposing sensitive code, data, or project information to unauthorized users.
If you can’t patch tonight, do this now.
As an interim measure, restrict or disable the policy bot feature if possible, and monitor access logs for unusual activity related to internal projects until the patch can be applied.
Patch, then assume compromise.
Upgrade GitLab EE to version 16.4.3, 16.5.3, 16.6.1 or later, where the vulnerability has been addressed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.