BIT-gitlab-2023-3906

vendorUSosv

Improper Validation of Specified Type of Input in GitLab

view advisory published 2024-03-06Licence: per source

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-3906US	low3.5	0.57% (47th)	—	2023-09-29
An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticate…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/gitlab/-/issues/419213ADVISORY
https://hackerone.com/reports/2071411WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-3906WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan