CVE-2023-6840 is a medium-severity vulnerability in GitLab EE, affecting versions 16.4 through 16.6.6, 16.7 through 16.7.4, and 16.8 through 16.8.1. This flaw allows a maintainer to rename a protected branch, thereby circumventing established security policies designed to block merge requests. The vulnerability has a CVSS score of 6.7 (Medium), indicating it can be exploited over the network with low attack complexity by a highly privileged user, leading to both high integrity and availability impacts. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 39/100. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, with only one mention and one article identified, primarily from a GitLab security release.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 16.4, < 16.6.7CPE match | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | ||
>= 16.7, < 16.7.5CPE match | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | ||
>= 16.8, < 16.8.2CPE match | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | ||
>= 16.4.0, < 16.6.7CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 16.7.0, < 16.7.5CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.