Path Traversal Vulnerability in GitLab CE/EE Versions
CVE-2023-2825

7.5HIGH

Key Information:

Vendor
GitLab
Status
GitLab
Vendor
CVE Published:
26 May 2023

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 74%📰 News Worthy

Summary

An exploit in GitLab CE/EE allows an unauthenticated user to leverage a path traversal vulnerability. This issue is particularly impactful in version 16.0.0, enabling attackers to read an arbitrary file on the server if the target file is associated with an attachment within a public project that exists in a nested structure of at least five groups. Organizations using this version of GitLab should take immediate action to mitigate potential risks.

Affected Version(s)

GitLab 16.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-2825
Created by Occamsec

CVE-2023-2825
Created by yuimarudev

CVE-2023-2825-Gitlab
Created by Tornad0007

News Articles

favicon imageLinkedIn

Komodo Cyber Security {www.komodosec.com} on LinkedIn: CVE-2023-2825: Critical bug in GitLab with CVSS score of 10

#Vulnerability #CVE20232825 CVE-2023-2825: Critical bug in GitLab with CVSS score of 10

2 years ago

References

https://gitlab.com/gitlab-org/gitlab/-/issues/412371
https://hackerone.com/reports/1994725
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE...

EPSS Score

74% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • Vulnerability published

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by LinkedIn

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database5 Proof of Concept(s)1 News Article(s)

Credit

Thanks [pwnie](https://hackerone.com/pwnie) for reporting this vulnerability through our HackerOne bug bounty program
.