CVE-2023-3385
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
An issue has been discovered in GitLab affecting all versions from 8.10 before 16.0.8, all versions from 16.1 before 16.1.3, and all versions from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive data within the system, posing a serious threat to the organization's security.
Recommendation
It is recommended to update GitLab to the latest version to mitigate this vulnerability and to monitor the system for unauthorized access.
Original NVD description (English source)
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).