CVE-2023-3385 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

Back Back to CVE browser

MEDIUM

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

Published Aug 1, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.86%

Description

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  16.1.0
  Status
  affected
  Constraints
  <16.1.3
- Version
  16.2.0
  Status
  affected
  Constraints
  <16.2.2
- Version
  8.10
  Status
  affected
  Constraints
  <16.0.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
16.1.0	affected	<16.1.3
16.2.0	affected	<16.2.2
8.10	affected	<16.0.8

Vendor GitLab Product GitLab Default
n/a
- Version
  16.1.0
  Status
  affected
  Constraints
  <16.1.3
- Version
  16.2.0
  Status
  affected
  Constraints
  <16.2.2
- Version
  8.10
  Status
  affected
  Constraints
  <16.0.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

n/a

Version	Status	Constraints
16.1.0	affected	<16.1.3
16.2.0	affected	<16.2.2
8.10	affected	<16.0.8

Product	Package	State	Advisory
Red Hat OpenShift Container Platform 4	openshift4/ose-console	Not affected	n/a

Remediation

Vendor solution

Upgrade to versions 16.2.2, 16.1.3, 16.0.8 or above.

Red Hat statement

The GitLab package used in OpenShift is a GitLab API NodeJS library which is not affected by CVE-2023-3385.

Weaknesses (1)

CWE-22

Path Traversal

References (7)

https://access.redhat.com/security/cve/CVE-2023-3385
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228523
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44052
Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/416161
issue-trackingBroken Link
https://hackerone.com/reports/2032730
technical-descriptionexploitpermissions-requiredPermissions Required
https://nvd.nist.gov/vuln/detail/CVE-2023-3385
https://www.cve.org/CVERecord?id=CVE-2023-3385

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-3385		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2228523		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44052		Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/416161		issue-trackingBroken Link
https://hackerone.com/reports/2032730		technical-descriptionexploitpermissions-requiredPermissions Required
https://nvd.nist.gov/vuln/detail/CVE-2023-3385
https://www.cve.org/CVERecord?id=CVE-2023-3385