CVE-2023-5226

MEDIUM

GitLab < 16.4.3, 16.5-16.5.2, 16.6-16.6.0 - Branch Name Validation Bypass

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI.

References (2)

Core 2
Core References
Broken Link, Vendor Advisory issue-tracking permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/426400
Permissions Required, Third Party Advisory technical-description exploit permissions-required
https://hackerone.com/reports/2173053

Scores

CVSS v3 4.8
EPSS 0.0011
EPSS Percentile 28.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-94
Status published
Products (5)
gitlab/gitlab 16.6.0 (2 CPE variants)
gitlab/gitlab < 16.4.3 (2 CPE variants)
GitLab/GitLab < 16.4.3
GitLab/GitLab 16.5 - 16.5.3
GitLab/GitLab 16.6 - 16.6.1
Published Dec 01, 2023
Tracked Since Feb 18, 2026