CVE-2023-3444
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An issue has been discovered in GitLab CE/EE that allows an attacker to merge arbitrary code into protected branches. This affects all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, and all versions starting from 16.1 before 16.1.1.
Risk Assessment
An attacker could introduce malicious code into protected branches, potentially leading to serious security breaches and loss of code integrity in the project.
Recommendation
It is recommended to upgrade GitLab to version 15.11.10 or later, 16.0.6 or later, and 16.1.1 or later to mitigate this vulnerability.
Original NVD description (English source)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches.