CVE-2023-6489
published 2024-04-12CVE-2023-6489: A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows…
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.60%
44.4th percentile
A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 17.3.5-2 (sid) | gitlab 17.3.5-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 16.10 < 16.10.2 | 16.10.2 |
| gitlab | gitlab | >= 16.10.0 < 16.10.2 | 16.10.2 |
| gitlab | gitlab | >= 16.7.7 < 16.8.6 | 16.8.6 |
| gitlab | gitlab | >= 16.9 < 16.9.4 | 16.9.4 |
| gitlab | gitlab | >= 16.9.0 < 16.9.4 | 16.9.4 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2023-6489: A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 whi
vendor_gitlab·2024-04-12·CVSS 4.3
CVE-2023-6489 [MEDIUM] CWE-1333 CVE-2023-6489: A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 whi
CVE-2023-6489: A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.
Debian
CVE-2023-6489: gitlab - A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7....
vendor_debian·2023·CVSS 4.3
CVE-2023-6489 [MEDIUM] CVE-2023-6489: gitlab - A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7....
A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.
Scope: local
sid: resolved (fixed in 17.3.5-2)
OSV
CVE-2023-6489: A denial of service vulnerability was identified in GitLab CE/EE, versions 16
osv·2024-04-12·CVSS 6.5
CVE-2023-6489 [MEDIUM] CVE-2023-6489: A denial of service vulnerability was identified in GitLab CE/EE, versions 16
A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.
GHSA
GHSA-997p-pqq2-w5f5: A denial of service vulnerability was identified in GitLab CE/EE, versions 16
ghsa_unreviewed·2024-04-12
CVE-2023-6489 [MEDIUM] CWE-1333 GHSA-997p-pqq2-w5f5: A denial of service vulnerability was identified in GitLab CE/EE, versions 16
A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-12
Published