May 28, 2023
GitLab Patches a Critical Account Takeover Vulnerability
GitLab released an emergency security update, version 16.0.1, to address a path traversal critical vulnerability with a maximum severity (CVSS score 10.0).
Successful exploitation may allow an unauthenticated attacker to access any file on the server and disclose sensitive data, including proprietary software code, user passwords, tokens, files, and other private information.
The Critical Vulnerability
- CVE-2023-2825, (CVSS 3.0: 10.0, Critical Severity) – Path traversal vulnerability in GitLab version 16.0, allows an unauthenticated attacker to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.
- GitLab CE/EE version 16.0.0.
CYREBRO recommends those who use GitLab and have installations running a version affected by the vulnerability to upgraded to the latest version as soon as possible.
References: GitLab Advisory