CVE-2023-5512 — Code Injection in Gitlab

CWE-94 — Code Injection5 documents5 sources
Severity
5.7MEDIUMNVD
EPSS
0.3%
top 47.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedDec 15

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:NExploitability: 2.1 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab16.3 — 16.4.4+2
▶NVDgitlab/gitlab16.3.0 — 16.4.4+2
▶debiandebian/gitlab< gitlab 16.4.4+ds2-2 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2023-5512: An issue has been discovered in GitLab CE/EE affecting all versions from 16↗2023-12-15
▶
GHSA
GHSA-3vp4-9jc4-q799: An issue has been discovered in GitLab CE/EE affecting all versions from 16↗2023-12-15
▶

📋Vendor Advisories

2
GitLab
CVE-2023-5512: An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versio↗2023-12-15
▶
Debian
CVE-2023-5512: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 be...↗2023
▶