CVE-2023-1204:GitLab CE/EE vulnerability allows users to set unverified emails as public and commit emails through crafted requests.

splash
Back

Description Preview

A security vulnerability in GitLab CE/EE affects all versions from 10.1 to 15.10.7, 15.11 to 15.11.6, and 16.0 to 16.0.1. The vulnerability allows users to bypass email verification controls by sending specially crafted requests during user settings updates, enabling them to use unverified email addresses as their public email and commit email. This could potentially lead to email spoofing and identity misrepresentation in commits and public profiles.

Overview

This vulnerability (CVE-2023-1204) in GitLab CE/EE allows users to circumvent the normal email verification process. By crafting specific requests when updating user settings, attackers can set unverified email addresses as their public email and commit email. This poses a security risk as it enables users to impersonate others by using email addresses they don't actually own or control. The issue affects a wide range of GitLab versions starting from 10.1 and was present for an extended period before being addressed in versions 15.10.8, 15.11.7, and 16.0.2.

Remediation

To address this vulnerability, GitLab administrators should upgrade to one of the following patched versions:

  • Version 15.10.8 or later (if running 15.10.x)
  • Version 15.11.7 or later (if running 15.11.x)
  • Version 16.0.2 or later (if running 16.0.x)

If immediate upgrading is not possible, monitor user email changes closely and consider implementing additional verification processes at the organizational level. Review commit histories for any suspicious email addresses that might indicate exploitation of this vulnerability.

References

  1. GitLab CVE Details: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1204.json
  2. GitLab Issue #394745: https://gitlab.com/gitlab-org/gitlab/-/issues/394745 (Note: This link may be restricted)
  3. HackerOne Report: https://hackerone.com/reports/1881598 (Note: Permissions required to access)

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Health Care & Social Assistance
    Health Care & Social Assistance
  2. Manufacturing
    Manufacturing
  3. Finance and Insurance
    Finance and Insurance
  4. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  5. Transportation & Warehousing
    Transportation & Warehousing
  6. Utilities
    Utilities
  7. Accommodation & Food Services
    Accommodation & Food Services
  8. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  9. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  10. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  11. Construction
    Construction
  12. Educational Services
    Educational Services
  13. Information
    Information
  14. Management of Companies & Enterprises
    Management of Companies & Enterprises
  15. Mining
    Mining
  16. Other Services (except Public Administration)
    Other Services (except Public Administration)
  17. Public Administration
    Public Administration
  18. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  19. Retail Trade
    Retail Trade
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background