Skip to content
OpenAdvisories
High NCSC-2024-0237 7 CVEs

Kwetsbaarheden verholpen in GitLab Enterprise Edition en Community Edition

Published May 27, 2024 · Updated May 27, 2024 · nl

Vendor: GitLab Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in Enterprise Edition (EE) en Community Edition (CE).

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service (DoS) te veroorzaken, of via een Cross-Site-Scripting-aanval (XSS) gevoelige gegevens te verzamelen om accounts over te nemen.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen in GitLab EE en CE 17.0.1, 16.11.3 en 16.10.6. Zie bijgevoegde referenties voor meer informatie.

https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/

Vulnerabilities 7

  • High 8.0
    CVE-2024-4835

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-2874

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.4
    CVE-2023-7045

    Cross-Site Request Forgery (CSRF) in GitLab

    A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By leveraging this vulnerability, an attacker could exfiltrate anti-CSRF tokens via the Kubernetes Agent Server (KAS).

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.4
    CVE-2024-5258

    Authorization Bypass Through User-Controlled Key in GitLab

    An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-6502

    Inefficient Regular Expression Complexity in GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-1947

    Improper Handling of Highly Compressed Data (Data Amplification) in GitLab

    A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted AP…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.0
    CVE-2024-5318

    Missing Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting from 17.0 prior to 17.0.1. A Guest user can view dependency lists of private projects through job arti…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #0

    Initiele versie

References

  • Reference - ncscclear
    https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/