Skip to content
OpenAdvisories
High NCSC-2024-0270 13 CVEs

Kwetsbaarheden verholpen in GitLab Enterprise Edition en Community Edition

Published Jun 27, 2024 · Updated Jul 4, 2024 · Revision 2 · nl

Vendor: GitLab Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab Enterprise Edition en Community Edition.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, om gegevens in de repositories te manipuleren, of om met rechten van een andere gebruiker, waaronder ook mogelijk functioneel/technisch beheerders of teamleads, willekeurige commando's uit te voeren.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen in GitLab EE en CE v 17.1.1, 17.0.3 en 16.11.5. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 13

  • Critical 9.6
    CVE-2024-5655

    Improper Access Control in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to trigger a pipeline as another user under certain circum…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.7
    CVE-2024-4901 EPSS 33%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious co…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.1
    CVE-2024-4994

    Cross-Site Request Forgery (CSRF) in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to t…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2024-6323

    Improper Isolation or Compartmentalization in GitLab

    Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project.

    GitLab GitLab Web / CMS
  • Medium 6.8
    CVE-2024-2177

    Improper Restriction of Rendered UI Layers or Frames in GitLab

    A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted paylo…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.8
    CVE-2024-5430

    Improper Access Control in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-1493

    Uncontrolled Resource Consumption in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regu…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-3959

    Improper Authorization in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-4557

    Uncontrolled Resource Consumption in GitLab

    Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1 which allowed an attacker to cause resource e…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2024-1816

    Uncontrolled Resource Consumption in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 12.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows for an attacker to cause a denial of service using a crafted OpenAPI f…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2024-2191

    Improper Access Control in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as projec…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-3115

    Exposure of Sensitive Information to an Unauthorized Actor in GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session usin…

    GitLab GitLab Web / CMS
  • Low 3.1
    CVE-2024-4011

    Improper Access Control in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives.

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Per abuis is er een kwetsbaarheid met kenmerk CVE-2024-5655 niet aan dit beveiligingsadvies toegevoegd. Deze is alsnog toegevoegd. Inschaling blijft ongewijzigd.

  2. #0

    Initiele versie

References