May 28, 2023

GitLab Patches a Critical Account Takeover Vulnerability

GitLab released an emergency security update, version 16.0.1, to address a path traversal critical vulnerability with a maximum severity (CVSS score 10.0).

Successful exploitation may allow an unauthenticated attacker to access any file on the server and disclose sensitive data, including proprietary software code, user passwords, tokens, files, and other private information.

The Critical Vulnerability

• CVE-2023-2825, (CVSS 3.0: 10.0, Critical Severity) – Path traversal vulnerability in GitLab version 16.0, allows an unauthenticated attacker to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

Affected Products

• GitLab CE/EE version 16.0.0.

Mitigation

CYREBRO recommends those who use GitLab and have installations running a version affected by the vulnerability to upgraded to the latest version as soon as possible.

References: GitLab Advisory