CVE-2023-6195

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-6195
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-6195.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-6195
Aliases
Downstream
Published
2025-01-30T23:45:10.780Z
Modified
2025-11-30T11:16:03.629850Z
Severity
  • 2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Server-Side Request Forgery (SSRF) in GitLab
Details

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image value when importing a GitHub repository.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6195.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
af0fced4dd2e767d361f2bdc0732be15ad2c1026
Fixed
6878f253b7b50c8e6217ebfd03717b5e5ea960a4
Database specific 
{
    "versions": [
        {
            "introduced": "15.5"
        },
        {
            "fixed": "16.9.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
053df647320e7cac5c255f9e07264a0c35548409
Fixed
f5974fc8f24e7033135f5b0d4f77b68886b2e298
Database specific 
{
    "versions": [
        {
            "introduced": "16.10"
        },
        {
            "fixed": "16.10.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
22834294718a25956b0a859c8eed72248300eeee
Fixed
d210b947e3e51eebcbb24a9152f5c68f7e2b1d58
Database specific 
{
    "versions": [
        {
            "introduced": "16.11"
        },
        {
            "fixed": "16.11.2"
        }
    ]
}

Affected versions

v16.*

v16.10.0-ee
v16.10.1-ee
v16.10.2-ee
v16.10.3-ee
v16.10.4-ee
v16.11.0-ee
v16.11.1-ee

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-6195.json"