HIGH

CVE-2023-3424

Gitlab GitLab 2023-07-13 CVSS v3.1

CVSS

7.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

Summary dbcve.org

A Regular Expression Denial of Service (ReDoS) vulnerability in GitLab's preview_markdown endpoint allows attackers to send crafted regex payloads that cause catastrophic backtracking, potentially hanging or crashing the GitLab service.

Mitigation

Upgrade GitLab to version 15.11.10, 16.0.6, 16.1.1 or later. Consider rate-limiting or temporarily disabling the preview_markdown endpoint as a defensive measure while planning the upgrade.

Weakness (CWE)

CWE-1333

EPSS Score

0.91%

Probability of exploitation in next 30 days

58.3th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/issues/409802 Broken Link, Vendor Advisory https://hackerone.com/reports/1960970 Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE