Cyber Resilience

CVE-2023-2022

Gitlab ≤ 16.0.8

Published
02 August 2023
Modified
21 November 2024
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0046 38th percentile
Risk Priority 37 floored blend · peak EPSS

Summary

CVE-2023-2022 is a medium-severity Not Using Password Aging (CWE-262) vulnerability in Gitlab Gitlab. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected…

more

branches even if they don't have access to merge

CWE(s)
CWE-262NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise Techniques

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1110.001 Password Guessing Credential Access
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
attack.mitre.org →
T1110.003 Password Spraying Credential Access
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.
attack.mitre.org →
T1110.004 Credential Stuffing Credential Access
Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap.
attack.mitre.org →
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-1555Same product: Gitlab Gitlab
CVE-2025-0605Same product: Gitlab Gitlab
CVE-2023-7028Same product: Gitlab Gitlab
CVE-2022-1162Same product: Gitlab Gitlab
CVE-2025-1754Same product: Gitlab Gitlab
CVE-2023-6477Same product: Gitlab Gitlab
CVE-2024-9164Same product: Gitlab Gitlab
CVE-2023-2485Same product: Gitlab Gitlab
CVE-2024-12303Same product: Gitlab Gitlab
CVE-2024-0410Same product: Gitlab Gitlab

Affected Assets

gitlab
gitlab
≤ 16.0.8 · ≤ 16.0.8 · 16.1 — 16.1.3

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-01 mostly match
prevents

Credential management explicitly includes lifecycle controls such as password aging and expiration.

PR.AA-03 partial match
prevents

Authentication policy enforcement can include password-aging rules even though the example text only cites strength.

PR.AA-05 partial match
prevents

Access-authorization policy can embed password-aging requirements as part of entitlement rules.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.17 Authentication information partial match
degrades

Requires policies and procedures for managing authentication information including password lifecycle.

A.8.5 Secure authentication partial match
degrades

Specifies secure authentication mechanisms that commonly include password aging and rotation requirements.

A.5.18 Access rights none match
none

Defines access rights provisioning but does not mandate password aging rules.

References