Action not permitted
Modal body text goes here.
wid-sec-w-2023-3041
Vulnerability from csaf_certbund
Published
2023-11-30 23:00
Modified
2023-12-04 23:00
Summary
GitLab: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.
Angriff
Ein entfernter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Berechtigungen zu erweitern oder XSS-Angriffe durchzuführen.
Betroffene Betriebssysteme
- Linux
- Sonstiges
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "GitLab ist eine Webanwendung zur Versionsverwaltung f\u00fcr Softwareprojekte auf Basis von git.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Berechtigungen zu erweitern oder XSS-Angriffe durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-3041 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3041.json" }, { "category": "self", "summary": "WID-SEC-2023-3041 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3041" }, { "category": "external", "summary": "GitLab Security Release vom 2023-11-30", "url": "https://about.gitlab.com/releases/2023/11/30/security-release-gitlab-16-6-1-released/" } ], "source_lang": "en-US", "title": "GitLab: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-12-04T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:52:55.223+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-3041", "initial_release_date": "2023-11-30T23:00:00.000+00:00", "revision_history": [ { "date": "2023-11-30T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-12-04T23:00:00.000+00:00", "number": "2", "summary": "Anpassung CVSS Score" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Open Source GitLab \u003c 16.6.1", "product": { "name": "Open Source GitLab \u003c 16.6.1", "product_id": "T031430", "product_identification_helper": { "cpe": "cpe:/a:gitlab:gitlab:16.6.1" } } }, { "category": "product_name", "name": "Open Source GitLab \u003c 16.5.3", "product": { "name": "Open Source GitLab \u003c 16.5.3", "product_id": "T031431", "product_identification_helper": { "cpe": "cpe:/a:gitlab:gitlab:16.5.3" } } }, { "category": "product_name", "name": "Open Source GitLab \u003c 16.4.3", "product": { "name": "Open Source GitLab \u003c 16.4.3", "product_id": "T031432", "product_identification_helper": { "cpe": "cpe:/a:gitlab:gitlab:16.4.3" } } } ], "category": "product_name", "name": "GitLab" } ], "category": "vendor", "name": "Open Source" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-6396", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-6396" }, { "cve": "CVE-2023-6033", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-6033" }, { "cve": "CVE-2023-5995", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-5995" }, { "cve": "CVE-2023-5226", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-5226" }, { "cve": "CVE-2023-4912", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-4912" }, { "cve": "CVE-2023-4658", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-4658" }, { "cve": "CVE-2023-4317", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-4317" }, { "cve": "CVE-2023-3964", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-3964" }, { "cve": "CVE-2023-3949", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-3949" }, { "cve": "CVE-2023-39417", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-39417" }, { "cve": "CVE-2023-3443", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-3443" }, { "cve": "CVE-2023-3401", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2023-3401" }, { "cve": "CVE-2022-41409", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in GitLab. Diese Fehler bestehen in mehreren Komponenten wie der Benutzeroberfl\u00e4che oder der Jira-Integrationskonfiguration, unter anderem aufgrund mehrerer Sicherheitsprobleme wie der unsachgem\u00e4\u00dfen Neutralisierung von Eingaben oder der unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung von Berechtigungen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Privilegien zu erweitern oder XSS-Angriffe durchzuf\u00fchren. Einige der Schwachstellen erfordern eine Interaktion des Benutzers, um sie erfolgreich auszunutzen." } ], "release_date": "2023-11-30T23:00:00Z", "title": "CVE-2022-41409" } ] }
cve-2022-41409
Vulnerability from cvelistv5
Published
2023-07-18 00:00
Modified
2024-10-28 18:22
Severity ?
EPSS score ?
Summary
Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T12:42:46.199Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://github.com/PCRE2Project/pcre2/issues/141" }, { "tags": [ "x_transferred" ], "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2022-41409", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-28T18:22:33.915896Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-28T18:22:42.917Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2023-07-18T00:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "url": "https://github.com/PCRE2Project/pcre2/issues/141" }, { "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35" } ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-41409", "datePublished": "2023-07-18T00:00:00", "dateReserved": "2022-09-26T00:00:00", "dateUpdated": "2024-10-28T18:22:42.917Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-3964
Vulnerability from cvelistv5
Published
2023-12-01 07:02
Modified
2024-10-03 06:23
Severity ?
EPSS score ?
Summary
Incorrect Authorization in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/419857 | issue-tracking | |
https://hackerone.com/reports/2037316 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:08:50.762Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #419857", "tags": [ "issue-tracking", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/419857" }, { "name": "HackerOne Bug Bounty Report #2037316", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2037316" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.4.3", "status": "affected", "version": "13.2", "versionType": "semver" }, { "lessThan": "16.5.3", "status": "affected", "version": "16.5", "versionType": "semver" }, { "lessThan": "16.6.1", "status": "affected", "version": "16.6", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [js_noob](https://hackerone.com/js_noob) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-03T06:23:13.469Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #419857", "tags": [ "issue-tracking" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/419857" }, { "name": "HackerOne Bug Bounty Report #2037316", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2037316" } ], "solutions": [ { "lang": "en", "value": "Upgrade to version 16.4.3, 16.5.3, or 16.6.1" } ], "title": "Incorrect Authorization in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-3964", "datePublished": "2023-12-01T07:02:18.158Z", "dateReserved": "2023-07-26T22:30:27.029Z", "dateUpdated": "2024-10-03T06:23:13.469Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-3949
Vulnerability from cvelistv5
Published
2023-12-01 07:02
Modified
2024-10-10 20:16
Severity ?
EPSS score ?
Summary
Insertion of Sensitive Information Into Sent Data in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/419664 | issue-tracking | |
https://hackerone.com/reports/2079374 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:08:50.845Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #419664", "tags": [ "issue-tracking", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/419664" }, { "name": "HackerOne Bug Bounty Report #2079374", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2079374" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-3949", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-01-10T16:38:37.303405Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-10T20:16:50.932Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.4.3", "status": "affected", "version": "11.3", "versionType": "semver" }, { "lessThan": "16.5.3", "status": "affected", "version": "16.5", "versionType": "semver" }, { "lessThan": "16.6.1", "status": "affected", "version": "16.6", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [ashish_r_padelkar](https://hackerone.com/ashish_r_padelkar) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects\u0027 release descriptions via an atom endpoint when release access on the public was set to only project members." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-03T06:23:13.377Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #419664", "tags": [ "issue-tracking" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/419664" }, { "name": "HackerOne Bug Bounty Report #2079374", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2079374" } ], "solutions": [ { "lang": "en", "value": "Upgrade to version 16.4.3, 16.5.3 or 16.6.1" } ], "title": "Insertion of Sensitive Information Into Sent Data in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-3949", "datePublished": "2023-12-01T07:02:13.130Z", "dateReserved": "2023-07-25T16:06:09.992Z", "dateUpdated": "2024-10-10T20:16:50.932Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-4317
Vulnerability from cvelistv5
Published
2023-12-01 07:02
Modified
2024-10-03 06:23
Severity ?
EPSS score ?
Summary
Incorrect Authorization in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/421846 | issue-tracking, permissions-required | |
https://hackerone.com/reports/2089517 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:24:03.786Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #421846", "tags": [ "issue-tracking", "permissions-required", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/421846" }, { "name": "HackerOne Bug Bounty Report #2089517", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2089517" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.4.3", "status": "affected", "version": "9.2", "versionType": "semver" }, { "lessThan": "16.5.3", "status": "affected", "version": "16.5", "versionType": "semver" }, { "lessThan": "16.6.1", "status": "affected", "version": "16.6", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [js_noob](https://hackerone.com/js_noob) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-03T06:23:14.260Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #421846", "tags": [ "issue-tracking", "permissions-required" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/421846" }, { "name": "HackerOne Bug Bounty Report #2089517", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2089517" } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 16.4.3, 16.5.3, 16.6.1 or above." } ], "title": "Incorrect Authorization in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-4317", "datePublished": "2023-12-01T07:02:03.130Z", "dateReserved": "2023-08-13T22:01:43.533Z", "dateUpdated": "2024-10-03T06:23:14.260Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-3401
Vulnerability from cvelistv5
Published
2023-08-02 08:30
Modified
2024-09-18 04:04
Severity ?
EPSS score ?
Summary
Improper Control of Generation of Code ('Code Injection') in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/416252 | issue-tracking | |
https://hackerone.com/reports/2031845 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-3401", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-07-24T13:55:12.534381Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-24T13:55:26.591Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T06:55:03.501Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #416252", "tags": [ "issue-tracking", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/416252" }, { "name": "HackerOne Bug Bounty Report #2031845", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2031845" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.0.8", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "16.1.3", "status": "affected", "version": "16.1.0", "versionType": "semver" }, { "lessThan": "16.2.2", "status": "affected", "version": "16.2.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [st4nly0n](https://hackerone.com/st4nly0n) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-09-18T04:04:45.195Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #416252", "tags": [ "issue-tracking" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/416252" }, { "name": "HackerOne Bug Bounty Report #2031845", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2031845" } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 16.2.2, 16.1.3, 16.0.8 or above." } ], "title": "Improper Control of Generation of Code (\u0027Code Injection\u0027) in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-3401", "datePublished": "2023-08-02T08:30:48.302Z", "dateReserved": "2023-06-26T10:17:32.851Z", "dateUpdated": "2024-09-18T04:04:45.195Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-5226
Vulnerability from cvelistv5
Published
2023-12-01 07:01
Modified
2024-09-18 04:07
Severity ?
EPSS score ?
Summary
Improper Control of Generation of Code ('Code Injection') in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/426400 | issue-tracking | |
https://hackerone.com/reports/2173053 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:52:08.425Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #426400", "tags": [ "issue-tracking", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/426400" }, { "name": "HackerOne Bug Bounty Report #2173053", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2173053" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.4.3", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "16.5.3", "status": "affected", "version": "16.5", "versionType": "semver" }, { "lessThan": "16.6.1", "status": "affected", "version": "16.6", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [shells3c](https://hackerone.com/shells3c) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-09-18T04:07:50.190Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #426400", "tags": [ "issue-tracking" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/426400" }, { "name": "HackerOne Bug Bounty Report #2173053", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2173053" } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 16.4.3, 16.5.3, 16.6.1 or above." } ], "title": "Improper Control of Generation of Code (\u0027Code Injection\u0027) in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-5226", "datePublished": "2023-12-01T07:01:43.131Z", "dateReserved": "2023-09-27T13:01:23.089Z", "dateUpdated": "2024-09-18T04:07:50.190Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-6033
Vulnerability from cvelistv5
Published
2023-12-01 07:01
Modified
2024-09-18 04:08
Severity ?
EPSS score ?
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/431201 | issue-tracking, permissions-required | |
https://hackerone.com/reports/2236039 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T08:21:17.132Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #431201", "tags": [ "issue-tracking", "permissions-required", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/431201" }, { "name": "HackerOne Bug Bounty Report #2236039", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2236039" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.4.3", "status": "affected", "version": "15.10", "versionType": "semver" }, { "lessThan": "16.5.3", "status": "affected", "version": "16.5", "versionType": "semver" }, { "lessThan": "16.6.1", "status": "affected", "version": "16.6", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim\u0027s browser." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-09-18T04:08:25.191Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #431201", "tags": [ "issue-tracking", "permissions-required" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/431201" }, { "name": "HackerOne Bug Bounty Report #2236039", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2236039" } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 16.6.1, 16.5.3, 16.4.3 or above." } ], "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-6033", "datePublished": "2023-12-01T07:01:38.124Z", "dateReserved": "2023-11-08T13:01:15.229Z", "dateUpdated": "2024-09-18T04:08:25.191Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-5995
Vulnerability from cvelistv5
Published
2023-12-01 07:01
Modified
2024-10-03 06:23
Severity ?
EPSS score ?
Summary
Incorrect Authorization in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/425361 | issue-tracking | |
https://hackerone.com/reports/2138880 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T08:14:25.158Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #425361", "tags": [ "issue-tracking", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/425361" }, { "name": "HackerOne Bug Bounty Report #2138880", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2138880" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.4.3", "status": "affected", "version": "16.2", "versionType": "semver" }, { "lessThan": "16.5.3", "status": "affected", "version": "16.5", "versionType": "semver" }, { "lessThan": "16.6.1", "status": "affected", "version": "16.6", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-03T06:23:16.500Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #425361", "tags": [ "issue-tracking" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/425361" }, { "name": "HackerOne Bug Bounty Report #2138880", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2138880" } ], "solutions": [ { "lang": "en", "value": "Upgrade to version 16.4.3, 16.5.3, 16.6.1, or above" } ], "title": "Incorrect Authorization in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-5995", "datePublished": "2023-12-01T07:01:28.253Z", "dateReserved": "2023-11-07T17:30:43.042Z", "dateUpdated": "2024-10-03T06:23:16.500Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-4658
Vulnerability from cvelistv5
Published
2023-12-01 07:01
Modified
2024-10-03 06:23
Severity ?
EPSS score ?
Summary
Incorrect Authorization in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/423835 | issue-tracking | |
https://hackerone.com/reports/2104540 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:31:06.624Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #423835", "tags": [ "issue-tracking", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/423835" }, { "name": "HackerOne Bug Bounty Report #2104540", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2104540" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.4.3", "status": "affected", "version": "8.13", "versionType": "semver" }, { "lessThan": "16.5.3", "status": "affected", "version": "16.5", "versionType": "semver" }, { "lessThan": "16.6.1", "status": "affected", "version": "16.6", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [theluci](https://hackerone.com/theluci) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-03T06:23:15.087Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #423835", "tags": [ "issue-tracking" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/423835" }, { "name": "HackerOne Bug Bounty Report #2104540", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2104540" } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 16.4.3, 16.5.3, 16.6.1 or above." } ], "title": "Incorrect Authorization in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-4658", "datePublished": "2023-12-01T07:01:58.125Z", "dateReserved": "2023-08-31T05:30:28.470Z", "dateUpdated": "2024-10-03T06:23:15.087Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-3443
Vulnerability from cvelistv5
Published
2023-12-01 07:02
Modified
2024-10-03 06:23
Severity ?
EPSS score ?
Summary
Incorrect Authorization in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/416497 | issue-tracking | |
https://hackerone.com/reports/2036500 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T06:55:03.511Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #416497", "tags": [ "issue-tracking", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/416497" }, { "name": "HackerOne Bug Bounty Report #2036500", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2036500" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.4.3", "status": "affected", "version": "12.1", "versionType": "semver" }, { "lessThan": "16.5.3", "status": "affected", "version": "16.5", "versionType": "semver" }, { "lessThan": "16.6.1", "status": "affected", "version": "16.6", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [ashish_r_padelkar](https://hackerone.com/ashish_r_padelkar) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-03T06:23:11.916Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #416497", "tags": [ "issue-tracking" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/416497" }, { "name": "HackerOne Bug Bounty Report #2036500", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2036500" } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 16.4.3, 16.5.3, 16.6.1 or above." } ], "title": "Incorrect Authorization in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-3443", "datePublished": "2023-12-01T07:02:33.126Z", "dateReserved": "2023-06-28T13:19:14.231Z", "dateUpdated": "2024-10-03T06:23:11.916Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-39417
Vulnerability from cvelistv5
Published
2023-08-11 12:19
Modified
2024-09-12 19:51
Severity ?
EPSS score ?
Summary
Postgresql: extension script @substitutions@ within quoting allow sql injection
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-39417", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-07-26T15:28:16.003937Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-26T15:28:30.775Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T18:10:20.829Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2023:7545", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7545" }, { "name": "RHSA-2023:7579", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7579" }, { "name": "RHSA-2023:7580", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7580" }, { "name": "RHSA-2023:7581", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7581" }, { "name": "RHSA-2023:7616", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7616" }, { "name": "RHSA-2023:7656", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7656" }, { "name": "RHSA-2023:7666", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7666" }, { "name": "RHSA-2023:7667", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7667" }, { "name": "RHSA-2023:7694", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7694" }, { "name": "RHSA-2023:7695", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7695" }, { "name": "RHSA-2023:7714", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7714" }, { "name": "RHSA-2023:7770", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7770" }, { "name": "RHSA-2023:7772", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7772" }, { "name": "RHSA-2023:7784", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7784" }, { "name": "RHSA-2023:7785", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7785" }, { "name": "RHSA-2023:7883", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7883" }, { "name": "RHSA-2023:7884", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7884" }, { "name": "RHSA-2023:7885", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2023:7885" }, { "name": "RHSA-2024:0304", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:0304" }, { "name": "RHSA-2024:0332", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:0332" }, { "name": "RHSA-2024:0337", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:0337" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-39417" }, { "name": "RHBZ#2228111", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228111" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00003.html" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20230915-0002/" }, { "tags": [ "x_transferred" ], "url": "https://www.debian.org/security/2023/dsa-5553" }, { "tags": [ "x_transferred" ], "url": "https://www.debian.org/security/2023/dsa-5554" }, { "tags": [ "x_transferred" ], "url": "https://www.postgresql.org/support/security/CVE-2023-39417" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.2::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-central-db-rhel8", "product": "Red Hat Advanced Cluster Security 4.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.2.4-6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.2::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.2.4-6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.2::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-operator-bundle", "product": "Red Hat Advanced Cluster Security 4.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.2.4-7", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.2::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-scanner-db-rhel8", "product": "Red Hat Advanced Cluster Security 4.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.2.4-6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.2::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8", "product": "Red Hat Advanced Cluster Security 4.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.2.4-7", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8090020231114113712.a75119d5", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8090020231128173330.a75119d5", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8090020231114113548.a75119d5", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_aus:8.2::appstream", "cpe:/a:redhat:rhel_e4s:8.2::appstream", "cpe:/a:redhat:rhel_tus:8.2::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8020020231128165246.4cda2c84", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_aus:8.2::appstream", "cpe:/a:redhat:rhel_e4s:8.2::appstream", "cpe:/a:redhat:rhel_tus:8.2::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8020020231128165246.4cda2c84", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_aus:8.2::appstream", "cpe:/a:redhat:rhel_e4s:8.2::appstream", "cpe:/a:redhat:rhel_tus:8.2::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8020020231128165246.4cda2c84", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_tus:8.4::appstream", "cpe:/a:redhat:rhel_e4s:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8040020231127153301.522a0ee4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_tus:8.4::appstream", "cpe:/a:redhat:rhel_e4s:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8040020231127154806.522a0ee4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_tus:8.4::appstream", "cpe:/a:redhat:rhel_e4s:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8040020231127153301.522a0ee4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_tus:8.4::appstream", "cpe:/a:redhat:rhel_e4s:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8040020231127154806.522a0ee4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_tus:8.4::appstream", "cpe:/a:redhat:rhel_e4s:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8040020231127153301.522a0ee4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_tus:8.4::appstream", "cpe:/a:redhat:rhel_e4s:8.4::appstream", "cpe:/a:redhat:rhel_aus:8.4::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8040020231127154806.522a0ee4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:8.6::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.6 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8060020231114115246.ad008a3a", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:8.6::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.6 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8060020231128165328.ad008a3a", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:8.8::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.8 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8080020231114105206.63b34585", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:8.8::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.8 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8080020231128165335.63b34585", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:8.8::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 8.8 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "8080020231113134015.63b34585", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb" ], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:13.13-1.el9_3", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "9030020231120082734.rhel9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:9.0::crb", "cpe:/a:redhat:rhel_eus:9.0::appstream" ], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.0 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:13.13-1.el9_0", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:9.2::crb", "cpe:/a:redhat:rhel_eus:9.2::appstream" ], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.2 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:13.13-1.el9_2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:9.2::appstream" ], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9.2 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "9020020231115020618.rhel9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_software_collections:3::el7" ], "defaultStatus": "affected", "packageName": "rh-postgresql12-postgresql", "product": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:12.17-1.el7", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_software_collections:3::el7" ], "defaultStatus": "affected", "packageName": "rh-postgresql13-postgresql", "product": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:13.13-1.el7", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:3.74::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-central-db-rhel8", "product": "RHACS-3.74-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "3.74.8-9", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:3.74::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "RHACS-3.74-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "3.74.8-9", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:3.74::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-operator-bundle", "product": "RHACS-3.74-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "3.74.8-7", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:3.74::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-scanner-db-rhel8", "product": "RHACS-3.74-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "3.74.8-9", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:3.74::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8", "product": "RHACS-3.74-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "3.74.8-9", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.1::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-central-db-rhel8", "product": "RHACS-4.1-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.1.6-6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.1::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "RHACS-4.1-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.1.6-6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.1::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-operator-bundle", "product": "RHACS-4.1-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.1.6-6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.1::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-scanner-db-rhel8", "product": "RHACS-4.1-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.1.6-6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:advanced_cluster_security:4.1::el8" ], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8", "product": "RHACS-4.1-RHEL-8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.1.6-6", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unknown", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "unaffected", "packageName": "postgresql:10/postgresql", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_software_collections:3" ], "defaultStatus": "affected", "packageName": "rh-postgresql10-postgresql", "product": "Red Hat Software Collections", "vendor": "Red Hat" } ], "datePublic": "2023-08-10T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, \u0027\u0027, or \"\"). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-09-12T19:51:10.673Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2023:7545", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7545" }, { "name": "RHSA-2023:7579", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7579" }, { "name": "RHSA-2023:7580", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7580" }, { "name": "RHSA-2023:7581", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7581" }, { "name": "RHSA-2023:7616", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7616" }, { "name": "RHSA-2023:7656", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7656" }, { "name": "RHSA-2023:7666", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7666" }, { "name": "RHSA-2023:7667", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7667" }, { "name": "RHSA-2023:7694", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7694" }, { "name": "RHSA-2023:7695", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7695" }, { "name": "RHSA-2023:7714", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7714" }, { "name": "RHSA-2023:7770", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7770" }, { "name": "RHSA-2023:7772", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7772" }, { "name": "RHSA-2023:7784", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7784" }, { "name": "RHSA-2023:7785", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7785" }, { "name": "RHSA-2023:7883", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7883" }, { "name": "RHSA-2023:7884", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7884" }, { "name": "RHSA-2023:7885", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2023:7885" }, { "name": "RHSA-2024:0304", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:0304" }, { "name": "RHSA-2024:0332", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:0332" }, { "name": "RHSA-2024:0337", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:0337" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-39417" }, { "name": "RHBZ#2228111", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228111" }, { "url": "https://www.postgresql.org/support/security/CVE-2023-39417" } ], "timeline": [ { "lang": "en", "time": "2023-08-01T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-08-10T00:00:00+00:00", "value": "Made public." } ], "title": "Postgresql: extension script @substitutions@ within quoting allow sql injection", "x_redhatCweChain": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-39417", "datePublished": "2023-08-11T12:19:15.108Z", "dateReserved": "2023-08-01T09:31:02.842Z", "dateUpdated": "2024-09-12T19:51:10.673Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-4912
Vulnerability from cvelistv5
Published
2023-12-01 07:01
Modified
2024-10-03 06:23
Severity ?
EPSS score ?
Summary
Allocation of Resources Without Limits or Throttling in GitLab
References
▼ | URL | Tags |
---|---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/424882 | issue-tracking | |
https://hackerone.com/reports/2137421 | technical-description, exploit, permissions-required |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:44:52.047Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GitLab Issue #424882", "tags": [ "issue-tracking", "x_transferred" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/424882" }, { "name": "HackerOne Bug Bounty Report #2137421", "tags": [ "technical-description", "exploit", "x_transferred" ], "url": "https://hackerone.com/reports/2137421" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "16.4.3", "status": "affected", "version": "10.5", "versionType": "semver" }, { "lessThan": "16.5.3", "status": "affected", "version": "16.5", "versionType": "semver" }, { "lessThan": "16.6.1", "status": "affected", "version": "16.6", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Thanks [toukakirishima](https://hackerone.com/toukakirishima) for reporting this vulnerability through our HackerOne bug bounty program" } ], "descriptions": [ { "lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-03T06:23:15.480Z", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab" }, "references": [ { "name": "GitLab Issue #424882", "tags": [ "issue-tracking" ], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/424882" }, { "name": "HackerOne Bug Bounty Report #2137421", "tags": [ "technical-description", "exploit", "permissions-required" ], "url": "https://hackerone.com/reports/2137421" } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 16.4.3, 16.5.3, 16.6.1 or above." } ], "title": "Allocation of Resources Without Limits or Throttling in GitLab" } }, "cveMetadata": { "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2023-4912", "datePublished": "2023-12-01T07:01:48.155Z", "dateReserved": "2023-09-12T13:30:21.852Z", "dateUpdated": "2024-10-03T06:23:15.480Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.