CVE-2023-3906

Published Sep 29, 2023

Last updated a month ago

Overview

Description
An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.
Source
cve@gitlab.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
3.5
Impact score
1.4
Exploitability score
2.1
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Severity
LOW

Weaknesses

nvd@nist.gov
NVD-CWE-Other
cve@gitlab.com
CWE-1287

Social media

Hype score
Not currently trending

Configurations