CVE-2023-3385 — Path Traversal in Gitlab

CWE-22 — Path Traversal6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 69.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedAug 2

Description

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5gitlab/gitlab16.1.0 — 16.1.3+1
▶NVDgitlab/gitlab8.10 — 16.0.8+2
▶debiandebian/gitlab< gitlab 16.0.8+ds1-1 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2023-3385: An issue has been discovered in GitLab affecting all versions starting from 8↗2023-08-02
▶
GHSA
GHSA-f8q5-vhrp-8mfc: An issue has been discovered in GitLab affecting all versions starting from 8↗2023-08-02
▶

📋Vendor Advisories

3
Red Hat
gitlab: tar utility causes importing a project access to read unauthorized files↗2023-08-02
▶
GitLab
CVE-2023-3385: An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all ver↗2023-08-02
▶
Debian
CVE-2023-3385: gitlab - An issue has been discovered in GitLab affecting all versions starting from 8.10...↗2023
▶