HIGH

CVE-2023-2199

Gitlab GitLab 2023-06-07 CVSS v3.1

CVSS

7.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

Summary dbcve.org

A Regular Expression Denial of Service (ReDoS) vulnerability exists in GitLab's preview_markdown endpoint. Attackers can send crafted regex payloads that cause excessive backtracking in the regex engine, leading to high CPU consumption and denial of service.

Mitigation

Upgrade GitLab to version 15.10.8, 15.11.7, or 16.0.2 or later to patch the vulnerability.

Weakness (CWE)

CWE-1333

EPSS Score

1.33%

Probability of exploitation in next 30 days

69.7th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2199.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/408272 Broken Link https://hackerone.com/reports/1943819 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE