Cyber Resilience

CVE-2023-3906

Low

Published: 29 September 2023

Published
29 September 2023
Modified
05 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS Score 0.0022 45.3th percentile
Risk Priority 7 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-3906 is a low-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Gitlab Gitlab. Its CVSS base score is 3.5 (Low).

Operationally, ranked at the 45.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset…

more

proxy.

CWE(s)
CWE-1287NVD-CWE-Other

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

gitlab
gitlab
16.4.0 · 12.3 — 16.2.8 · 12.3 — 16.2.8 · 16.3.0 — 16.3.5

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References