CVE-2023-2022

MEDIUM

GitLab CE/EE <16.0.8, <16.1.3, <16.2.2 - Info Disclosure

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge

References (2)

Core 2
Core References
Permissions Required technical-description exploit permissions-required
https://hackerone.com/reports/1936572

Scores

CVSS v3 4.3
EPSS 0.0015
EPSS Percentile 34.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-262
Status published
Products (1)
gitlab/gitlab < 16.0.8 (2 CPE variants)
Published Aug 02, 2023
Tracked Since Feb 18, 2026