CVE-2023-0508

LOW

GitLab 15.4.0-15.10.7, 15.11.0-15.11.6, 16.0.0-16.0.1 - HTTP Response Splitting via NPM Package API

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.

References (3)

Core 3

Scores

CVSS v3 3.1
EPSS 0.0076
EPSS Percentile 50.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-113
Status published
Products (1)
gitlab/gitlab 15.4.0 - 15.10.8 (2 CPE variants)
Published Jun 07, 2023
Tracked Since Feb 18, 2026