MEDIUM
CVE-2023-1787
CVSS
5.3
Description
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description.
Summary dbcve.org
A denial-of-service vulnerability in GitLab allows attackers to trigger a search timeout by inserting a specific HTML payload into an issue description. The malformed payload causes excessive resource consumption during search operations, rendering the search functionality unavailable until the timeout occurs.
Mitigation
Upgrade GitLab to version 15.9.4, 15.10.1, or later. Alternatively, restrict the ability to create/edit issues to trusted users until the upgrade can be performed.
Weakness (CWE)
CWE-400
Uncontrolled Resource Consumption
EPSS Score
0.75%
Probability of exploitation in next 30 days
53.5th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.