CVE-2023-5356

CVSS 3.1: 8.8 high
EPSS: <1%p55
Published: Jan 12, 2024 · Jan 12, 2024
Modified: Jun 17, 2026

Analyze CVE-2023-5356 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.

Vendors: gitlab

Products: gitlab

Weakness: CWE-863

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news

3 stories

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

Help Net SecurityMay 2, 08:55 UTC · May 2, 2024VulnerabilityExploitedCVE-2023-7028 CVE-2023-5356 CVE-2023-4812+24 · 1 read

GitLab fixed a critical zero

Security AffairsJan 13, 17:52 UTC · Jan 13, 2024VulnerabilityCVE-2023-7028 CVE-2023-5356 CVE-2023-4812+25 · 1 read

Urgent: GitLab Releases Patch for Critical Vulnerabilities

The Hacker NewsJan 12, 13:29 UTC · Jan 12, 2024VulnerabilityCVE-2023-7028 CVE-2023-53565