MEDIUM

CVE-2023-3210

Gitlab GitLab 2023-09-01 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.

Summary dbcve.org

An authenticated user can trigger a denial of service by importing or cloning malicious content in GitLab versions 15.11 through 16.3.0. The vulnerability lies in the import/clone functionality which fails to properly handle specially crafted content, causing the service to become unavailable.

Mitigation

Upgrade GitLab to version 16.1.5, 16.2.5, 16.3.1 or later to patch the vulnerability. Until upgraded, limit import/clone permissions to trusted users.

Weakness (CWE)

CWE-1333

EPSS Score

0.81%

Probability of exploitation in next 30 days

55.4th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/issues/415074 Issue Tracking, Vendor Advisory https://hackerone.com/reports/2011474 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE