CVE-2023-4647: Allocation of Resources Without Limits or Throttling in GitLab
First published: Fri Sep 01 2023(Updated: )
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.
Credit: cve@gitlab.com cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab GitLab | >=15.2.0<16.1.5 | |
| GitLab GitLab | >=15.2.0<16.1.5 | |
| GitLab GitLab | >=16.2<16.2.5 | |
| GitLab GitLab | >=16.2<16.2.5 | |
| GitLab GitLab | =16.3.0 | |
| GitLab GitLab | =16.3.0 | |
| >=15.2.0<16.1.5 | ||
| >=15.2.0<16.1.5 | ||
| >=16.2<16.2.5 | ||
| >=16.2<16.2.5 | ||
| =16.3.0 | ||
| =16.3.0 |
Remedy
Upgrade to versions 16.3.1, 16.2.5, 16.1.5 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-4647?
CVE-2023-4647 is a vulnerability in GitLab that affects all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, and all versions starting from 16.3 before 16.3.1.
What is the severity of CVE-2023-4647?
CVE-2023-4647 has a severity rating of 7.5 (high).
How does CVE-2023-4647 impact GitLab?
CVE-2023-4647 allows the skipping of projects API pagination, leading to potential denial-of-service (DoS) attacks on certain instances of GitLab.
Which versions of GitLab are affected by CVE-2023-4647?
CVE-2023-4647 affects all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, and all versions starting from 16.3 before 16.3.1 of GitLab.
Is there a fix for CVE-2023-4647?
Yes, upgrading to GitLab version 16.1.5, 16.2.5, or 16.3.1 will fix the vulnerability.
- agent/author
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/softwarecombine
- agent/description
- agent/remedy
- agent/severity
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/tags
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/gitlab
- canonical/gitlab gitlab
- version/gitlab gitlab/15.2.0
- version/gitlab gitlab/16.2
- version/gitlab gitlab/16.3.0