CVE-2023-5061: 
GitLab vulnerability analysis and mitigation

CVE-2023-5061 is a security vulnerability discovered in GitLab affecting all versions from 9.3 before 16.4.4, versions from 16.5 before 16.5.4, and versions from 16.6 before 16.6.2. The vulnerability allows developers to potentially override predefined CI variables via the REST API in certain situations (GitLab Release, NVD).

The vulnerability is rated as medium severity with a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The issue specifically relates to the ability to bypass restrictions on predefined CI variables through the REST API, even when the system is configured to restrict variable overrides (GitLab Release).

When exploited, this vulnerability allows developers to override predefined CI variables via the REST API, potentially bypassing intended security controls. This could lead to unauthorized modification of CI/CD pipeline behaviors that are meant to be restricted (GitLab Release).

The vulnerability has been fixed in GitLab versions 16.4.4, 16.5.4, and 16.6.2. Users are strongly recommended to upgrade to these or later versions to mitigate the vulnerability (GitLab Release).

The vulnerability was responsibly disclosed through GitLab's HackerOne bug bounty program by security researcher ali_shehab (GitLab Release).