PT-2023-32445 · Gitlab · Gitlab Ce/Ee+1

CVE-2023-5963 · Publicado 2023-11-06 · Atualizado 2024-10-03

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.9 through 16.3.6 GitLab EE version 16.4 prior to 16.4.2 GitLab EE version 16.5 prior to 16.5.1

Description An issue has been discovered in GitLab EE with Advanced Search that could allow a denial of service in the Advanced Search function by chaining too many syntax operators.

Recommendations For GitLab EE versions 13.9 through 16.3.6, update to a version after 16.3.6 to resolve the issue. For GitLab EE version 16.4 prior to 16.4.2, update to version 16.4.2 or later to resolve the issue. For GitLab EE version 16.5 prior to 16.5.1, update to version 16.5.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Advanced Search function to minimize the risk of exploitation.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BIT-GITLAB-2023-5963

CVE-2023-5963

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5963.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-5963 · Aviso do Fabricante
• https://gitlab.com/gitlab-org/gitlab/-/issues/423468 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-5963 · Nota de Segurança
• https://twitter.com/zeeshankghouri/status/1722108102487765412 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-gitlab-2023-5963 · Aviso do Fabricante
• https://t.me/cibsecurity/73612 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5963 · Nota