First published: Fri Dec 01 2023(Updated: )
An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.
Credit: cve@gitlab.com
Affected Software | Affected Version | How to fix |
---|---|---|
GitLab GitLab | >=10.5.0<16.4.3 | |
GitLab GitLab | >=16.5.0<16.5.3 | |
GitLab GitLab | =16.6.0 |
Upgrade to versions 16.4.3, 16.5.3, 16.6.1 or above.
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID of this issue is CVE-2023-4912.
The severity of CVE-2023-4912 is medium with a CVSS score of 6.5.
All versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, and version 16.6.0 of GitLab are affected by CVE-2023-4912.
This vulnerability allows an attacker to cause a client-side denial of service using malicious crafted mermaid diagrams.
Upgrade GitLab to version 16.4.3 or later, version 16.5.3 or later, or version 16.6.1 or later to fix the vulnerability.