CVE-2023-3904

An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/418226	Broken Link
https://hackerone.com/reports/2053154	Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/418226	Broken Link
https://hackerone.com/reports/2053154	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

21 Nov 2024, 08:18

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 4.3
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/418226 - Broken Link~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/418226 - Broken Link
References	~~() https://hackerone.com/reports/2053154 - Permissions Required~~	() https://hackerone.com/reports/2053154 - Permissions Required

03 Oct 2024, 07:15

Type	Values Removed	Values Added
CWE	~~CWE-284~~	CWE-1287

19 Dec 2023, 21:41

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~4.3~~	v2 : unknown v3 : 7.5
Summary		(es) Se ha descubierto un problema en GitLab EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones anteriores a 16.5 anteriores a 16.5.4, todas las versiones anteriores a 16.6 anteriores a 16.6.2. Ha sido posble hacer un desbordamiento del tiempo dedicado a un issue que alteró los detalles mostrados en los tableros de issues.
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/418226 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/418226 - Broken Link
References	~~() https://hackerone.com/reports/2053154 -~~	() https://hackerone.com/reports/2053154 - Permissions Required
CWE		NVD-CWE-Other
First Time		Gitlab Gitlab gitlab
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

15 Dec 2023, 16:53

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-15 16:15

Updated : 2024-11-21 08:18

NVD link : CVE-2023-3904

Mitre link : CVE-2023-3904

CVE.ORG link : CVE-2023-3904

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-1287

Improper Validation of Specified Type of Input

NVD-CWE-Other

{"id": "CVE-2023-3904", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-12-15T16:15:43.387", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418226", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/2053154", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418226", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://hackerone.com/reports/2053154", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-1287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones anteriores a 16.5 anteriores a 16.5.4, todas las versiones anteriores a 16.6 anteriores a 16.6.2. Ha sido posble hacer un desbordamiento del tiempo dedicado a un issue que alter\u00f3 los detalles mostrados en los tableros de issues."}], "lastModified": "2024-11-21T08:18:19.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "8C804A75-C14D-4AD1-8347-3F85B8889C5C", "versionEndExcluding": "16.4.4"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "B9D88266-872E-4BD9-B3DF-D1C540E66AFD", "versionEndExcluding": "16.5.4", "versionStartIncluding": "16.5"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "D5C45787-C8C9-432E-8DAF-6F5264BBE0B3", "versionEndExcluding": "16.6.2", "versionStartIncluding": "16.6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}

4.3 /10