CVE-2023-3906

EUVD-2023-44532
An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
GitLabCNA
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
Affected Products (NVD)
VendorProductVersion
gitlabgitlab
12.3 ≤
𝑥
< 16.2.8
gitlabgitlab
12.3 ≤
𝑥
< 16.2.8
gitlabgitlab
16.3.0 ≤
𝑥
< 16.3.5
gitlabgitlab
16.3.0 ≤
𝑥
< 16.3.5
gitlabgitlab
16.4.0
gitlabgitlab
16.4.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gitlab
sid
16.8.4-1
fixed
Common Weakness Enumeration
References
https://gitlab.com/gitlab-org/gitlab/-/issues/419213
https://hackerone.com/reports/2071411
https://gitlab.com/gitlab-org/gitlab/-/issues/419213
https://hackerone.com/reports/2071411