CVE-2023-1178
MEDIUMGitLab 8.6-15.9.5, 15.10-15.10.4, 15.11 - File Integrity Compromise via Tag or Release Reference
Title source: llmDescription
An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.
References (3)
Core 3
Core References
Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1178.json
Permissions Required, Third Party Advisory
https://hackerone.com/reports/1778009
Scores
CVSS v3
5.7
EPSS
0.0948
EPSS Percentile
92.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-94
Status
published
Products (1)
gitlab/gitlab
8.6.0 - 15.9.6 (2 CPE variants)
Published
May 03, 2023
Tracked Since
Feb 18, 2026