CVE-2023-5332 Dependency on Vulnerable Third-Party Component in GitLab
Attackers can bypass a security patch in the Consul library if the enable-script-checks setting is not disabled in GitLab EE.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-5332?
CVE-2023-5332 is a medium-severity vulnerability in Gitlab Gitlab, published on 4 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
Weakness: CWE-1395
Which versions are affected by CVE-2023-5332?
2 open source packages ship an affected version, including gitlab and consul. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
gitlab Bitnami | From 9.5.0 | 16.2.8, 16.3.5, 16.4.1 |
consul Bitnami | All versions | 0.9.4, 1.0.8, 1.1.1, 1.2.4 |
Products include Gitlab Gitlab, Hashicorp Consul.
How do I fix CVE-2023-5332?
Upgrade gitlab to a fixed version for your release line: 16.2.8, 16.3.5 or 16.4.1.
Is CVE-2023-5332 being exploited?
There is no known exploitation of CVE-2023-5332 in the wild and no public exploit code.
Other vulnerabilities in Gitlab Gitlab
- CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound
- CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal
- CVE-2023-7028 GitLab Community and Enterprise Editions Improper Access Control
- CVE-2021-22205 GitLab Community and Enterprise Editions Remote Code Execution
- CVE-2021-39935 GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF)
Sources
Also known as BIT-consul-2023-5332, BIT-gitlab-2023-5332, DEBIAN-CVE-2023-5332, GHSA-xcgm-v273-44cr, UBUNTU-CVE-2023-5332.