GitLab Denial of Service Vulnerability Affects Chat Integration

CVE-2023-6489
4.3MEDIUM

Key Information

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
12 April 2024

Summary

A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.

Affected Version(s)

GitLab < 16.8.6

GitLab < 16.9.4

GitLab < 16.10.2

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Thanks `Anonymizer` for reporting this vulnerability through our HackerOne bug bounty program
.