CVE-2023-5009

CVSS 3.1: 9.8 critical
EPSS: 8%p95
Published: Sep 19, 2023 · Sep 19, 2023
Modified: Jun 17, 2026

Analyze CVE-2023-5009 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact.

Vendors: gitlab

Products: gitlab

Weakness: CWE-863

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (8.3%)

In the news

6 stories

New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution

The Hacker NewsOct 11, 06:29 UTC · Oct 11, 2024VulnerabilityExploitedCVE-2024-9164 CVE-2024-8970 CVE-2024-8977+62 · 1 read

Urgent: GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Execution

The Hacker NewsSep 12, 15:55 UTC · Sep 12, 2024VulnerabilityExploitedCVE-2024-6678 CVE-2023-5009 CVE-2024-5655+23 · 1 read

Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE

Help Net SecuritySep 24, 00:00 UTC · Sep 24, 2023VulnerabilityExploitedCVE-2023-41179 CVE-2023-41992 CVE-2023-41991+62 · 1 read

Description · NVD

In the news

New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution

Urgent: GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Execution

Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE

GitLab fixes critical vulnerability, patch now! (CVE-2023-5009)

GitLab Releases Urgent Security Patches for Critical Vulnerability

GitLab addressed critical vulnerability CVE-2023