CRITICAL

CVE-2023-1708

Gitlab GitLab 2023-04-05 CVSS v3.1

CVSS

9.8

Description

An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.

Summary dbcve.org

GitLab CE/EE fails to sanitize or filter non-printable characters when processing clipboard content, allowing specially crafted clipboard data to trigger command execution on the victim's machine. This appears to be a client-side vulnerability where malicious characters or escape sequences copied into the clipboard are processed without proper sanitization.

Mitigation

Upgrade GitLab to version 15.8.5, 15.9.4, or 15.10.1 or later to patch the clipboard handling vulnerability.

Weakness (CWE)

CWE-77 Command Injection

CWE-94 Code Injection

EPSS Score

1.11%

Probability of exploitation in next 30 days

64.4th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1708.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/387185 Broken Link https://hackerone.com/reports/1805604 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE