CVE-2023-1708
Published: 05 April 2023
Summary
CVE-2023-1708 is a medium-severity Command Injection (CWE-77) vulnerability in Gitlab Gitlab. Its CVSS base score is 5.7 (Medium).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-1708 affects GitLab Community Edition and Enterprise Edition in all versions from 1.0 up to but not including 15.8.5, 15.9.4, and 15.10.1. The flaw allows non-printable characters to be copied from the clipboard in a manner that can result in unexpected commands executing on the machine where the content is later pasted. It is tracked under CWE-77 and CWE-94 with a CVSS 3.1 base score of 5.7.
An authenticated attacker with low privileges can prepare content containing the problematic characters and make it available through GitLab. A victim who copies that content and pastes it into a terminal or command interpreter on their local system will execute the injected commands, producing an integrity impact without requiring further authentication on the victim machine.
GitLab has published fixes in the referenced security releases and maintains a CVE record detailing the affected ranges. Administrators are expected to upgrade to 15.8.5, 15.9.4, or 15.10.1 (or newer) to eliminate the issue.
The associated EPSS score has remained flat at 0.0902 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-23932
Vulnerability details
An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.