Lucene search

Veracode Vulnerability DatabaseVERACODE:41522

HistoryJul 23, 2023 - 8:13 a.m.

Denial Of Service (DoS)

2023-07-2308:13:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

gitlab

dos attacks

pypi

api

resource consumption

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

42.1%

JSON

gitlab is vulnerable to Denial of Service (DoS) attacks. The library does not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption, resulting in denial of service conditions.

References

gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1431.json

gitlab.com/gitlab-org/gitlab/-/issues/262724

hackerone.com/reports/996850

security-tracker.debian.org/tracker/CVE-2022-1431

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

42.1%

JSON

Related for VERACODE:41522