Description
An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 12.3 – < 16.2.8, 16.3 – < 16.3.5, 16.4 – < 16.4.1 | 16.2.8 |
Advisories 1
- WID-SEC-2023-2520 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 28, 2023
References
- GitLab Issue #419213 issue-tracking
- HackerOne Bug Bounty Report #2071411 technical-description exploit permissions-required broken-link