CVE-2023-3401 — Code Injection in Gitlab

CWE-94 — Code InjectionCWE-862 — Missing Authorization6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 53.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabMatrix-org Matrix-js-sdk
Timeline
PublishedAug 2

Description

An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab16.1.0 — 16.1.3+1
▶NVDgitlab/gitlab16.1 — 16.1.3+2
▶debiandebian/gitlab< gitlab 16.0.8+ds1-1 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

3
GHSA
GHSA-722v-49rj-hh57: An issue has been discovered in GitLab affecting all versions before 16↗2023-08-02
▶
OSV
CVE-2023-3401: An issue has been discovered in GitLab affecting all versions before 16↗2023-08-02
▶
GHSA
matrix-js-sdk vulnerable to invisible eavesdropping in group calls↗2023-04-14
▶

📋Vendor Advisories

2
GitLab
CVE-2023-3401: An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from↗2023-08-02
▶
Debian
CVE-2023-3401: gitlab - An issue has been discovered in GitLab affecting all versions before 16.0.8, all...↗2023
▶