CVE-2023-0508

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-0508
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-0508.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-0508
Aliases
Downstream
Published
2023-06-07T00:00:00Z
Modified
2026-03-13T07:17:46.964031Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLab
Details

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.

Database specific 
{
    "cwe_ids": [
        "CWE-113"
    ],
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0508.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
073a4ba8016203c9e48595afd3ddea430d9420a3
Fixed
9ec5f337f9fecb932051eca4d24744475f25870e
Database specific 
{
    "versions": [
        {
            "introduced": "12.9"
        },
        {
            "fixed": "15.10.8"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
4dce6bc3728f63bc9086ff3088cda7527f6f0bec
Fixed
a81364cc950ad7396dbe403a87bb398d52ca9994
Database specific 
{
    "versions": [
        {
            "introduced": "15.11"
        },
        {
            "fixed": "15.11.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
280a09dbca836a6eedf5da1e63953fe8da44bf4c
Fixed
a1daac1686c9dad556b2fa9324f107fb72eae066
Database specific 
{
    "versions": [
        {
            "introduced": "16.0"
        },
        {
            "fixed": "16.0.2"
        }
    ]
}

Affected versions

v15.*
v15.11.0-ee
v15.11.1-ee
v15.11.2-ee
v15.11.3-ee
v15.11.4-ee
v15.11.5-ee
v15.11.6-ee
v16.*
v16.0.0-ee
v16.0.1-ee

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-0508.json"