SecuriTricks - CVE-2024-1493

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server

Product(s) Impacted

Product	Versions
GitLab CE/EE	['9.2 - 16.11.5', '17.0 - 17.0.3', '17.1 - 17.1.1']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References

https://gitlab.com/gitlab-org/gitlab/-/issues/441806

https://hackerone.com/reports/2370084

CVSS Score

6.5 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

View Vector String

Timeline

Published: June 27, 2024, 12:15 a.m.
Last Modified: June 27, 2024, 12:47 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@gitlab.com

CVE-2024-1493