MEDIUM

CVE-2023-5512

Gitlab GitLab 2023-12-15 CVSS v3.1

CVSS

5.7

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI.

Summary dbcve.org

GitLab CE/EE contains a vulnerability where specific HTML encoding used in file names can cause incorrect representation in the UI, potentially compromising file integrity visibility. The issue allows maliciously crafted file names with HTML encoding to display differently than their actual names, which could mislead users about file contents.

Mitigation

Upgrade GitLab to version 16.4.4, 16.5.4, or 16.6.2 or later to resolve the file name encoding issue.

Weakness (CWE)

CWE-94 Code Injection

EPSS Score

0.49%

Probability of exploitation in next 30 days

41.5th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/issues/427827 Broken Link https://hackerone.com/reports/2194607 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE