MEDIUM

CVE-2023-1178

Gitlab GitLab 2023-05-03 CVSS v3.1

CVSS

5.7

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.

Summary dbcve.org

GitLab CE/EE does not properly verify file integrity when source code or installation packages are pulled from tags or releases that contain a reference to another commit. This allows an attacker to potentially serve different content than intended, compromising the integrity of downloaded artifacts.

Mitigation

Upgrade GitLab to version 15.9.6, 15.10.5, or 15.11.1 or later to resolve the file integrity verification issue.

Weakness (CWE)

CWE-94 Code Injection

EPSS Score

0.89%

Probability of exploitation in next 30 days

57.9th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1178.json Third Party Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/381815 Broken Link https://hackerone.com/reports/1778009 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE