BIT-gitlab-2023-6195

vendorUSosv

Server-Side Request Forgery (SSRF) in GitLab

view advisory published 2025-02-01Licence: per source

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image value when importing a GitHub repository.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-6195US	medium4.3	0.32% (25th)	—	2025-01-31
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/gitlab/-/issues/432276EVIDENCE
https://hackerone.com/reports/2249268WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-6195WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan