title: Improper Access Control in GitLab
description: A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user.
problem types: CWE-284: Improper Access Control
affected:
{
vendor: GitLab
product: GitLab
repo: git://git@gitlab.com:gitlab-org/gitlab.git
versions:
version: 16.4, status: affected, lessThan: 16.4.1, versionType: semver
version: 16.3, status: affected, lessThan: 16.3.5, versionType: semver
version: 16.0.0, status: affected, lessThan: 16.2.8, versionType: semver
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
]
solutions: Upgrade to versions 16.4.1, 16.3.5, 16.2.8 or above.