CVE-2023-0155 : An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.

An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown

Published 2023-05-03 21:15:16

Updated 2023-05-09 19:53:24

Source GitLab Inc.

View at NVD, CVE.org

Vulnerability category: Open redirect

Products affected by CVE-2023-0155

Gitlab » Gitlab » Community Edition
Versions before (<) 15.8.5
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions before (<) 15.8.5
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 15.9 and before (<) 15.9.5
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 15.9 and before (<) 15.9.5
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Enterprise Edition
Versions from including (>=) 15.10 and before (<) 15.10.1
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Matching versions
Gitlab » Gitlab » Community Edition
Versions from including (>=) 15.10 and before (<) 15.10.1
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-0155

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 28 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-0155

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L	2.3	2.7	GitLab Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: None Integrity: Low Availability: Low
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L	2.3	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: None Integrity: Low Availability: Low

CWE ids for CVE-2023-0155

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-0155

https://gitlab.com/gitlab-org/gitlab/-/issues/387638

Not Found
Exploit;Third Party Advisory
https://hackerone.com/reports/1817250

HackerOne
Permissions Required
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0155.json

2023/CVE-2023-0155.json · master · GitLab.org / cves · GitLab
Third Party Advisory

Jump to

Vulnerability Details : CVE-2023-0155

Products affected by CVE-2023-0155

Exploit prediction scoring system (EPSS) score for CVE-2023-0155

CVSS scores for CVE-2023-0155

CWE ids for CVE-2023-0155

References for CVE-2023-0155