Vulnerability · Published Sep 29, 2023 · Assigned by GitLab
CVE-2023-3906Improper Validation of Specified Type of Input in GitLab
Low 3.5
In plain English
A low-severity security flaw in GitLab from GitLab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.6%top 52.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.
Affected products (as reported)
Weakness: CWE-1287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
References
- GitLab Issue #419213 issue-tracking
- HackerOne Bug Bounty Report #2071411 technical-description, exploit, permissions-required, broken-link