Lucene search

[email protected]NVD:CVE-2023-3364

HistoryAug 02, 2023 - 12:15 a.m.

CVE-2023-3364

2023-08-0200:15:18

CWE-400

CWE-1333

[email protected]

web.nvd.nist.gov

gitlab

security issue

regex

dos

autolinkfilter

payload

cve-2023-3364

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

38.4%

JSON

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.

Affected configurations

Nvd

Node

gitlabgitlabRange8.14–16.0.8community

gitlabgitlabRange8.14–16.0.8enterprise

gitlabgitlabRange16.1–16.1.3community

gitlabgitlabRange16.1–16.1.3enterprise

gitlabgitlabRange16.2–16.2.2community

gitlabgitlabRange16.2–16.2.2enterprise

VendorProductVersionCPE
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::community:::*
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

References

gitlab.com/gitlab-org/gitlab/-/issues/415995

hackerone.com/reports/1959727

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

38.4%

JSON

Related for NVD:CVE-2023-3364

redhatcve1 vulnrichment1 cve1 osv2 debiancve1 ubuntucve1 nessus2 veracode1 cvelist1 prion1 freebsd1