CVE-2023-2825

2023-05-2600:00:00

GitLab

www.cve.org

gitlab

path traversal

vulnerability

server

unauthenticated user

public project

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

9.4 High

AI Score

Confidence

High

0.159 Low

EPSS

Percentile

96.0%

JSON

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

CNA Affected

[
  {
    "vendor": "GitLab",
    "product": "GitLab",
    "versions": [
      {
        "version": "16.0.0",
        "status": "affected"
      }
    ]
  }
]