HIGH

CVE-2023-2132

Gitlab GitLab 2023-06-06 CVSS v3.1

CVSS

7.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted payloads to the preview_markdown endpoint.

Summary dbcve.org

A Regular Expression Denial of Service (ReDoS) vulnerability in GitLab's DollarMathPostFilter allows attackers to send crafted payloads to the preview_markdown endpoint, causing the regex engine to consume excessive CPU resources and potentially hang the application.

Mitigation

Upgrade GitLab to version 15.10.8, 15.11.7, or 16.0.2 or later to patch the vulnerable DollarMathPostFilter regex processing.

Weakness (CWE)

CWE-1333

EPSS Score

1.33%

Probability of exploitation in next 30 days

69.7th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2132.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/407586 Broken Link https://hackerone.com/reports/1934711 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE