CVE-2023-0121
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.24% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/387549Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/1774688Permissions Required, Third Party Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/387549Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/1774688Permissions Required, Third Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/387549Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.