CVE-2023-2181

2023-05-1200:00:00

ubuntu.com

cve-2023-2181

gitlab

security issue

refs/replace

version 15.11.3

merge request

review

content smuggling

unix

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

50.4%

JSON

An issue has been discovered in GitLab affecting all versions before
15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious
developer could use a git feature called refs/replace to smuggle content
into a merge request which would not be visible during review in the UI.