VULNERABILITY INTELLIGENCE

CVE-2023-3906

CVSS score3.5 LOW

EPSS probability0.57%

CISA KEVNot currently listed

Published2023-09-29

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Description

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.

Weakness classification

CWE-1287: Improper Validation of Specified Type of Input

Primary references

cve@gitlab.com — Issue Tracking, Vendor Advisory
cve@gitlab.com — Permissions Required
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required