CVE-2023-4647: Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-4647?
CVE-2023-4647 is a vulnerability in GitLab that affects all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, and all versions starting from 16.3 before 16.3.1.
What is the severity of CVE-2023-4647?
CVE-2023-4647 has a severity rating of 7.5 (high).
How does CVE-2023-4647 impact GitLab?
CVE-2023-4647 allows the skipping of projects API pagination, leading to potential denial-of-service (DoS) attacks on certain instances of GitLab.
Which versions of GitLab are affected by CVE-2023-4647?
CVE-2023-4647 affects all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, and all versions starting from 16.3 before 16.3.1 of GitLab.
Is there a fix for CVE-2023-4647?
Yes, upgrading to GitLab version 16.1.5, 16.2.5, or 16.3.1 will fix the vulnerability.