CVE-2023-3904

An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/418226	Broken Link
https://hackerone.com/reports/2053154	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

03 Oct 2024, 07:15

Type	Values Removed	Values Added
CWE	~~CWE-284~~	CWE-1287

19 Dec 2023, 21:41

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
First Time		Gitlab gitlab Gitlab
References	~~() https://hackerone.com/reports/2053154 -~~	() https://hackerone.com/reports/2053154 - Permissions Required
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/418226 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/418226 - Broken Link
CWE		NVD-CWE-Other

15 Dec 2023, 16:53

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-15 16:15

Updated : 2024-10-03 07:15

NVD link : CVE-2023-3904

Mitre link : CVE-2023-3904

CVE.ORG link : CVE-2023-3904

JSON object : View

Products Affected

gitlab

gitlab

CWE

NVD-CWE-Other CWE-1287

Improper Validation of Specified Type of Input

{"id": "CVE-2023-3904", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-12-15T16:15:43.387", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418226", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/2053154", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-1287"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones anteriores a 16.5 anteriores a 16.5.4, todas las versiones anteriores a 16.6 anteriores a 16.6.2. Ha sido posble hacer un desbordamiento del tiempo dedicado a un issue que alter\u00f3 los detalles mostrados en los tableros de issues."}], "lastModified": "2024-10-03T07:15:13.653", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "8C804A75-C14D-4AD1-8347-3F85B8889C5C", "versionEndExcluding": "16.4.4"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "B9D88266-872E-4BD9-B3DF-D1C540E66AFD", "versionEndExcluding": "16.5.4", "versionStartIncluding": "16.5"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "D5C45787-C8C9-432E-8DAF-6F5264BBE0B3", "versionEndExcluding": "16.6.2", "versionStartIncluding": "16.6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}