CVE-2023-3385

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-3385
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/416161 Broken Link
https://hackerone.com/reports/2032730 Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/416161 Broken Link
https://hackerone.com/reports/2032730 Permissions Required
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
History

21 Nov 2024, 08:17

Type Values Removed Values Added
Summary
  • (es) Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 8.10 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 16.2 antes de la 16.2.2. En determinadas circunstancias, un usuario que importaba un proyecto "desde exportación" podía acceder a archivos no relacionados y leerlos mediante la carga de un archivo especialmente diseñado. Esto se debía a un error en `tar`, corregido en [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
References () https://gitlab.com/gitlab-org/gitlab/-/issues/416161 - Broken Link () https://gitlab.com/gitlab-org/gitlab/-/issues/416161 - Broken Link
References () https://hackerone.com/reports/2032730 - Permissions Required () https://hackerone.com/reports/2032730 - Permissions Required
CVSS v2 : unknown
v3 : 6.5 		v2 : unknown
v3 : 6.3

04 Aug 2023, 19:19

Type Values Removed Values Added
CWE CWE-22
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
References (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/416161 - (MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/416161 - Broken Link
References (MISC) https://hackerone.com/reports/2032730 - (MISC) https://hackerone.com/reports/2032730 - Permissions Required
CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

02 Aug 2023, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-08-02 00:15

Updated : 2024-11-21 08:17

NVD link : CVE-2023-3385

Mitre link : CVE-2023-3385

CVE.ORG link : CVE-2023-3385

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')