An input validation issue in the asset proxy in GitLab EE... · CVE-2023-3906 · GitHub Advisory Database · GitHub

An input validation issue in the asset proxy in GitLab EE...

Low severity Unreviewed Published Sep 29, 2023 to the GitHub Advisory Database • Updated Apr 4, 2024

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.

References

Published by the National Vulnerability Database

Sep 29, 2023

Published to the GitHub Advisory Database Sep 29, 2023

Last updated Apr 4, 2024

Severity

Low

3.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N