CVE-2023-5963
Allocation of Resources Without Limits or Throttling in GitLab
Severity Score
4.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators.
Se ha descubierto un problema en GitLab EE con Advanced Search que afecta a todas las versiones desde 13.9 a 16.3.6, 16.4 anterior a 16.4.2 y 16.5 anterior a 16.5.1 que podría permitir una denegación de servicio en la función de Advanced Search al encadenar demasiadas operadores de sintaxis.
*Credits:
This vulnerability was found internally by GitLab.
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-11-06 CVE Reserved
- 2023-11-06 CVE Published
- 2024-10-03 CVE Updated
- 2024-11-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/423468 | Broken Link |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 13.9.0 <= 16.3.6 Search vendor "Gitlab" for product "Gitlab" and version " >= 13.9.0 <= 16.3.6" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | >= 16.4.0 < 16.4.2 Search vendor "Gitlab" for product "Gitlab" and version " >= 16.4.0 < 16.4.2" | enterprise |
Affected
| ||||||
| Gitlab Search vendor "Gitlab" | Gitlab Search vendor "Gitlab" for product "Gitlab" | 16.5.0 Search vendor "Gitlab" for product "Gitlab" and version "16.5.0" | enterprise |
Affected
| ||||||