CVE-2023-5512

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

A

n issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI.

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/427827	Broken Link
https://hackerone.com/reports/2194607	Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/427827	Broken Link
https://hackerone.com/reports/2194607	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

21 Nov 2024, 08:41

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~5.7~~	v2 : unknown v3 : 4.8
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/427827 - Broken Link~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/427827 - Broken Link
References	~~() https://hackerone.com/reports/2194607 - Permissions Required~~	() https://hackerone.com/reports/2194607 - Permissions Required

Information

Published : 2023-12-15 16:15

Updated : 2024-11-21 08:41

NVD link : CVE-2023-5512

Mitre link : CVE-2023-5512

CVE.ORG link : CVE-2023-5512

JSON object : View

Products Affected

gitlab

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2023-5512", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "published": "2023-12-15T16:15:46.300", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/427827", "tags": ["Broken Link"], "source": "[email protected]"}, {"url": "https://hackerone.com/reports/2194607", "tags": ["Permissions Required"], "source": "[email protected]"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/427827", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://hackerone.com/reports/2194607", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en GitLab CE/EE que afecta a todas las versiones desde 16.3 anteriores a 16.4.4, todas las versiones desde 16.5 anteriores a 16.5.4, todas las versiones desde 16.6 anteriores a 16.6.2. La integridad del archivo puede verse comprometida cuando se utiliza una codificaci\u00f3n HTML espec\u00edfica para nombres de archivos que provocan una representaci\u00f3n incorrecta en la interfaz de usuario."}], "lastModified": "2024-11-21T08:41:54.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "FC12E182-B115-419E-B2DF-AC30E3EF5F10", "versionEndExcluding": "16.4.4", "versionStartIncluding": "16.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E4A325F9-7186-4061-B299-106849B7A5DA", "versionEndExcluding": "16.4.4", "versionStartIncluding": "16.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "3C213E8A-B47E-4D1F-8253-90CB866744F0", "versionEndExcluding": "16.5.4", "versionStartIncluding": "16.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E6EBFF85-99EE-48D7-8991-02AA59E78374", "versionEndExcluding": "16.5.4", "versionStartIncluding": "16.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "17596227-79F6-439A-89EC-B87F03EF73AC", "versionEndExcluding": "16.6.2", "versionStartIncluding": "16.6.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "53E94AC5-C346-4511-B68C-DC0D86E575FC", "versionEndExcluding": "16.6.2", "versionStartIncluding": "16.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}