CVE-2023-0921

MEDIUM severity · CVSS 4.3 · Resource exhaustion

4.3CVSS MEDIUM

Summary

A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactLow

Exploit probability (EPSS)17%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products we track (1)

GitLab

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0921.jsonAdvisory
https://gitlab.com/gitlab-org/gitlab/-/issues/392433Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0921.jsonAdvisory
https://gitlab.com/gitlab-org/gitlab/-/issues/392433Advisory
https://hackerone.com/reports/1869839Advisory
https://hackerone.com/reports/1869839Advisory