Vulnerability Details : CVE-2023-6678
An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file.
Vulnerability category: Denial of service
Products affected by CVE-2023-6678
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-6678
0.32%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 54 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-6678
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
2.8
|
1.4
|
GitLab Inc. | 2024-04-12 |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST | 2024-12-11 |
CWE ids for CVE-2023-6678
-
The product does not properly control the allocation and maintenance of a limited resource.Assigned by: cve@gitlab.com (Secondary)
-
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.Assigned by:
- cve@gitlab.com (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2023-6678
-
https://hackerone.com/reports/2268037
Sign in | HackerOnePermissions Required
-
https://gitlab.com/gitlab-org/gitlab/-/issues/434689
Not FoundBroken Link
Jump to