Security readout for executives and security teams
Plain-English summary
Some GitLab versions can be pushed into excessive resource use through the projects API because pagination can be bypassed. The known business impact is availability: certain instances may suffer denial of service. The issue is medium severity and requires authenticated access, but exposed GitLab instances should still be upgraded promptly.
Executive priority
Treat as a moderate availability risk. It is not marked as exploited in KEV, but affected GitLab instances can be business-critical. Schedule remediation through normal urgent patching, prioritizing externally reachable or heavily used environments.
Technical view
CVE-2023-4647 is a CWE-770 resource allocation flaw in GitLab. Affected versions start at 15.2 before 16.1.5, 16.2 before 16.2.5, and 16.3 before 16.3.1. The projects API pagination can be skipped, potentially causing DoS on certain instances. CVSS 3.1 is 5.3 with PR:L and A:H.
Likely exposure
Exposure is most likely on GitLab instances running the listed affected version ranges where authenticated users can reach the projects API. The source bundle does not identify specific deployment types, configurations, or internet-facing requirements beyond network access and low privileges in the CVSS vector.
Exploitation context
The source bundle does not show known active exploitation, and KEV is false. The vulnerability has high attack complexity and requires low privileges. Impact is availability only in the CVSS data, with no stated confidentiality or integrity impact.
Researcher notes
Evidence is limited to the CVE record, CVE JSON, and GitLab issue reference. The key technical claim is pagination bypass in the projects API causing potential DoS. Do not assume broader API impact, unauthenticated exploitation, or data compromise without additional vendor evidence.
Mitigation direction
- Upgrade GitLab to 16.1.5, 16.2.5, 16.3.1, or a later fixed version.
- Check GitLab vendor guidance for any deployment-specific mitigations or advisories.
- Prioritize instances with many users or broad API accessibility.
- Limit unnecessary authenticated API access where operationally feasible.
Validation and detection
- Inventory GitLab versions and compare them with the affected ranges.
- Confirm whether authenticated users can access the projects API.
- Review availability monitoring for unexplained GitLab resource spikes or outages.
- Verify upgraded instances report a fixed or later GitLab version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-4647 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H1.63.6GitLabVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitLab Issue #414502CVE reference, GitLab · issue-tracking
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.