CVE-2023-3900
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.
Risk Assessment
The organization may experience downtime in the functionality related to merge requests, which could impact the productivity of development teams.
Recommendation
It is recommended to update GitLab CE/EE to version 16.1.3 or 16.2.2 to mitigate this vulnerability.
Original NVD description (English source)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.