Riskcovery

CVE-2023-6680

Improper Certificate Validation in GitLab

State
Published
Severity
7.4 High
Published
Dec 15, 2023
Updated
Jun 6, 2026
Reserved
Dec 11, 2023

Read the record on cve.org

Description

An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication. Smartcard authentication is an experimental feature and has to be manually enabled by an administrator.

Scores

CVSSScoreVectorSource
3.17.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NGitLab

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
GitLabGitLab
  • 11.6 to before 16.4.4Affected
  • 16.5 to before 16.5.4Affected
  • 16.6 to before 16.6.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.