{"id":"CVE-2023-3917","state":"PUBLISHED","title":"Improper Validation of Specified Type of Input in GitLab","description":"Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.","publishedAt":"2023-09-29T06:02:26.304Z","updatedAt":"2026-04-29T04:04:53.712Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"GitLab"},"assigner":"GitLab","products":["GitLab GitLab"],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"16.2.8","versionType":"semver"},{"version":"16.3","status":"affected","lessThan":"16.3.5","versionType":"semver"},{"version":"16.4","status":"affected","lessThan":"16.4.1","versionType":"semver"}],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"]}],"references":["https://gitlab.com/gitlab-org/gitlab/-/issues/417896","https://hackerone.com/reports/2055158"],"weaknesses":["CWE-1287"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/3xxx/CVE-2023-3917.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-3917","state":"PUBLISHED","datePublished":"2023-09-29T06:02:26.304Z","dateUpdated":"2026-04-29T04:04:53.712Z","assignerShortName":"GitLab","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateReserved":"2023-07-25T10:30:32.198Z"},"containers":{"cna":{"title":"Improper Validation of Specified Type of Input in GitLab","descriptions":[{"lang":"en","value":"Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail."}],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"16.2.8","versionType":"semver"},{"version":"16.3","status":"affected","lessThan":"16.3.5","versionType":"semver"},{"version":"16.4","status":"affected","lessThan":"16.4.1","versionType":"semver"}],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/417896","name":"GitLab Issue #417896","tags":["issue-tracking","permissions-required"]},{"url":"https://hackerone.com/reports/2055158","name":"HackerOne Bug Bounty Report #2055158","tags":["technical-description","exploit","permissions-required"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1287","lang":"en","description":"CWE-1287: Improper Validation of Specified Type of Input","type":"CWE"}]}],"providerMetadata":{"shortName":"GitLab","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateUpdated":"2026-04-29T04:04:53.712Z"},"solutions":[{"lang":"en","value":"Upgrade to version 16.4.1, 16.3.5 or 16.2.8"}],"credits":[{"lang":"en","value":"Thanks [js_noob](https://hackerone.com/js_noob) for reporting this vulnerability through our HackerOne bug bounty program","type":"finder"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/417896","name":"GitLab Issue #417896","tags":["issue-tracking","x_transferred"]},{"url":"https://hackerone.com/reports/2055158","name":"HackerOne Bug Bounty Report #2055158","tags":["technical-description","exploit","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:08:50.793Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-30T15:40:36.735432Z","id":"CVE-2023-3917","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-30T15:40:49.497Z"}}]}}}