CVE-2023-6736
Assigner: GitLab
Published: 2024-02-07T22:02:30.947Z
State: PUBLISHED
title: Uncontrolled Resource Consumption in GitLab
descriptions: value: An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted content in the CODEOWNERS file.
affected: vendor: GitLab
product: GitLab
repo: git://git@gitlab.com:gitlab-org/gitlab.git
versions: version: 11.3
status: affected
lessThan: 16.7.6
versionType: semver
version: 16.8
status: affected
lessThan: 16.8.3
versionType: semver
version: 16.9
status: affected
lessThan: 16.9.1
versionType: semver
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-400: Uncontrolled Resource Consumption
cweId: CWE-400
type: CWE
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
solutions: value: Upgrade to versions 16.9.1, 16.8.3, 16.7.6 or above.
credits: value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
type: finder