CVE-2023-3906

LOW 3.5EPSS 0.5%

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.

CVSS v3.1: 3.5 LOWCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v3.1: 3.5 LOWCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS: 0.48% chance of exploitation in the next 30 days, 40th percentile
Published: 2023-09-29
Updated: 2026-08-14

Proof-of-concept exploits (1)

https://hackerone.com/reports/2071411

References

Related