GitLab has shipped security patches to resolve a critical flaw that allows an attacker to run pipelines as another user.
The issue, tracked as CVE-2023-5009 (CVSS score: 9.6), impacts all versions of GitLab Enterprise Edition (EE) starting from 13.12 and prior to 16.2.7 as well as from 16.3 and before 16.3.4.
Security researcher Johan Carlsson (aka joaxcar) has been credited with discovering and reporting the flaw. CVE-2023-3932 was addressed by GitLab in early August 2023.
The new vulnerability has been remediated in GitLab versions 16.3.4 and 16.2.7.
The disclosure comes as a two-year-old critical GitLab bug (CVE-2021-22205, CVSS score: 10.0) continues to be actively exploited by threat actors in real-world attacks.
Earlier this week, Trend Micro revealed that a China-linked adversary known as Earth Lusca is aggressively targeting public-facing servers by weaponizing N-day security flaws, including CVE-2021-22205, to infiltrate victim networks.
It’s highly recommended that users update their GitLab installations to the latest version as soon as possible to safeguard against potential risks.
Source: https://thehackernews.com/
