CVE-2023-0121

MEDIUM severity · CVSS 6.5 · Resource exhaustion

6.5CVSS MEDIUM

Summary

A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)2%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products we track (1)

GitLab

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.jsonAdvisory
https://gitlab.com/gitlab-org/gitlab/-/issues/387549Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.jsonAdvisory
https://gitlab.com/gitlab-org/gitlab/-/issues/387549Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/387549Advisory
https://hackerone.com/reports/1774688Advisory
https://hackerone.com/reports/1774688Advisory