CVE-2023-0121

A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/387549	Broken Link
https://hackerone.com/reports/1774688	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

14 Jun 2023, 01:03

Type	Values Removed	Values Added
First Time		Gitlab Gitlab gitlab
CWE		CWE-400
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:::::community:::*
References	~~(CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json -~~	(CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json - Vendor Advisory
References	~~(MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/387549 -~~	(MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/387549 - Broken Link
References	~~(MISC) https://hackerone.com/reports/1774688 -~~	(MISC) https://hackerone.com/reports/1774688 - Permissions Required, Third Party Advisory

07 Jun 2023, 17:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-06-07 17:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-0121

Mitre link : CVE-2023-0121

CVE.ORG link : CVE-2023-0121

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-0121", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-06-07T17:15:09.727", "references": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json", "tags": ["Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/387549", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/1774688", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts."}], "lastModified": "2023-06-14T01:03:58.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "47CF7160-B10A-4F08-9F88-CD16666A78D0", "versionEndExcluding": "15.10.8", "versionStartIncluding": "13.2.4"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "71449E20-5C25-48A6-901F-9A1A57855717", "versionEndExcluding": "15.10.8", "versionStartIncluding": "13.2.4"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C612DD9C-BFBD-49A3-9936-BB7D2C7ADBED", "versionEndExcluding": "15.11.7", "versionStartIncluding": "15.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A6944880-86FD-4D58-8217-667BD48B019A", "versionEndExcluding": "15.11.7", "versionStartIncluding": "15.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C060C573-5005-487A-8AB2-DE66531685A1", "versionEndExcluding": "16.0.2", "versionStartIncluding": "16.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "D19BAB29-C57C-4410-A093-44AFFF3984DF", "versionEndExcluding": "16.0.2", "versionStartIncluding": "16.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}