CVE-2023-5933

2024-01-2601:15:08

CWE-80

CWE-79

[email protected]

web.nvd.nist.gov

gitlab

vulnerability

input sanitization

api

put requests

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.002

Percentile

60.0%

JSON

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.

Affected configurations

Nvd

Node

gitlabgitlabRange13.7.0–16.6.6community

gitlabgitlabRange13.7.0–16.6.6enterprise

gitlabgitlabRange16.7.0–16.7.4community

gitlabgitlabRange16.7.0–16.7.4enterprise

gitlabgitlabMatch16.8.0community

gitlabgitlabMatch16.8.0enterprise

VendorProductVersionCPE
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
gitlabgitlab16.8.0cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:community:*:*:*
gitlabgitlab16.8.0cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::community:::*
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
gitlab	gitlab	16.8.0	cpe:2.3:a:gitlab:gitlab:16.8.0::::community:::
gitlab	gitlab	16.8.0	cpe:2.3:a:gitlab:gitlab:16.8.0::::enterprise:::