PT-2023-26824 · Gitlab · Gitlab Ce/Ee+1

Js_Noob · Publicado 2023-09-28 · Atualizado 2024-10-03 · CVE-2023-3917

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Gitlab EE and CE versions prior to 16.2.8 Gitlab EE and CE version 16.3 prior to 16.3.5 Gitlab EE and CE version 16.4 prior to 16.4.1

Description The issue allows an attacker to cause pipelines to fail, resulting in a Denial of Service. This affects all versions of Gitlab EE and CE prior to the specified versions.

Recommendations For Gitlab EE and CE versions prior to 16.2.8, update to version 16.2.8 or later. For Gitlab EE and CE version 16.3 prior to 16.3.5, update to version 16.3.5 or later. For Gitlab EE and CE version 16.4 prior to 16.4.1, update to version 16.4.1 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1287

Identificadores relacionados

BIT-GITLAB-2023-3917

CVE-2023-3917

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3917.json · Exploit
• 🔥 https://hackerone.com/reports/2055158 · Exploit
• https://twitter.com/CVEnew/status/1707641361669734865 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-3917 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3917 · Nota
• https://osv.dev/vulnerability/BIT-gitlab-2023-3917 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-3917 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-3917 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-3917 · Aviso do Fabricante
• https://twitter.com/fletch_ai/status/1710839187472019878 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3917 · Aviso do Fabricante
• https://t.me/cibsecurity/71264 · Publicação no Telegram
• https://gitlab.com/gitlab-org/gitlab/-/issues/417896 · Nota