Dependency on Vulnerable Third-Party Component in GitLab
Priority LOW 37CWE-1395Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 11 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
Why it matters now
EPSS 0.00872 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial GitLab (GitLab): 16.2.8, 16.3.5, 16.4.1Red Hat: 11 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GitLab | GitLab | 9.5.0 to before 16.2.8; 16.3.0 to before 16.3.5; 16.4 to before 16.4.1 | 16.2.8, 16.3.5, 16.4.1 | Patch available | CNA |
- GitLab VendorGitLab Affected 9.5.0 to before 16.2.8; 16.3.0 to before 16.3.5; 16.4 to before 16.4.1 Fixed in 16.2.8, 16.3.5, 16.4.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | 9.5.0 to before 16.2.8; 16.3.0 to before 16.3.5 | Vulnerable | GitLab |
| cpe:2.3:a:gitlab:gitlab:16.4.0:*:*:*:enterprise:*:*:* | 16.4.0 | Vulnerable | GitLab |
| cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* | before 0.9.4; 1.0.0 to before 1.0.8; 1.2.0 to before 1.2.4 | Vulnerable | HashiCorp |
| cpe:2.3:a:hashicorp:consul:1.1.0:*:*:*:-:*:*:* | 1.1.0 | Vulnerable | HashiCorp |
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* Versions 9.5.0 to before 16.2.8; 16.3.0 to before 16.3.5 Vulnerable ·GitLab
- cpe:2.3:a:gitlab:gitlab:16.4.0:*:*:*:enterprise:*:*:* Versions 16.4.0 Vulnerable ·GitLab
- cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* Versions before 0.9.4; 1.0.0 to before 1.0.8; 1.2.0 to before 1.2.4 Vulnerable ·HashiCorp
- cpe:2.3:a:hashicorp:consul:1.1.0:*:*:*:-:*:*:* Versions 1.1.0 Vulnerable ·HashiCorp
Remediation
- Fix · CNA GitLab (GitLab) Fixed in 16.2.8, 16.3.5, 16.4.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Sandboxed Containers | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix yet |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
Not affected: 11 products
- Custom Metric Autoscaler operator for Red Hat Openshift
- Logging Subsystem for Red Hat OpenShift
- OpenShift API for Data Protection
- OpenShift Serverless
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Data Science (RHODS)
- Red Hat OpenShift Dev Spaces
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Container Storage 4
- Red Hat Openshift Data Foundation 4
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5332
- 2026-10-03 Alias added: GHSA-xcgm-v273-44cr
References
More Gitlab vulnerabilities
- TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
- TI-2026-58817 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab KEVCVSS 3.1CRITICAL 10.0
- TI-2023-06425 Weak Password Recovery Mechanism for Forgotten Password in GitLab KEVCVSS 3.1CRITICAL 10.0
- TI-2021-05191 Code injection in GitLab KEVCVSS 3.1CRITICAL 10.0
- TI-2021-05161 Server-side request forgery in GitLab KEVCVSS 3.1CRITICAL 9.8
- TI-2022-02763 Injection in GitLab CVSS 3.1CRITICAL 9.9
Sources
- CVE-2023-5332 · CVE Program
- CVE-2023-5332 · NVD
- FIRST EPSS
- GHSA-xcgm-v273-44cr · GitHub Advisory Database · CC BY 4.0
- CVE-2023-5332 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences