MEDIUM

CVE-2023-3205

Gitlab GitLab 2023-09-01 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.

Summary dbcve.org

An authenticated GitLab user can trigger a denial of service condition by importing or cloning maliciously crafted content, affecting all versions from 15.11 through 16.3.x prior to the patched releases.

Mitigation

Upgrade GitLab to version 16.1.5, 16.2.5, 16.3.1 or later. Until patched, limit import/clone operations from untrusted sources.

Weakness (CWE)

CWE-1333

EPSS Score

0.85%

Probability of exploitation in next 30 days

56.6th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/issues/415067 Issue Tracking, Vendor Advisory https://hackerone.com/reports/2011464 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE