CVE-2023-4895

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-4895
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-4895.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-4895
Aliases
Downstream
Published
2024-02-22T00:02:43.649Z
Modified
2025-11-29T15:38:44.619595Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Missing Authorization in GitLab
Details

An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' settings to access environment details of projects

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4895.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
3b13818e8330f68625d80d9bf5d8049c41fbe197
Fixed
c8f3448a2f0cfb3c812fc4619e0f16bc3feb133b
Database specific 
{
    "versions": [
        {
            "introduced": "12.0"
        },
        {
            "fixed": "16.7.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1e912d57d5a8f1135f4d41e25469069790134d41
Fixed
39213e8fab4a70aa7cf64bb1c75012bb11fd7b15
Database specific 
{
    "versions": [
        {
            "introduced": "16.8"
        },
        {
            "fixed": "16.8.3"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
76326ae8b898b38c8217ad037ed7122be00e62f0
Fixed
cc62007c12dc634c7442a9b1dc94508e50e5dba5
Database specific 
{
    "versions": [
        {
            "introduced": "16.9"
        },
        {
            "fixed": "16.9.1"
        }
    ]
}

Affected versions

v16.*

v16.8.0-ee
v16.8.1-ee
v16.8.2-ee
v16.9.0-ee
v16.9.0-rc44-ee