Skip to content
OpenAdvisories
High NCSC-2024-0406 8 CVEs

Kwetsbaarheden verholpen in Gitlab Enterprise Edition en Community Edition

Published Oct 11, 2024 · Updated Oct 11, 2024 · nl

Vendor: GitLab Vendor: OpenSource Product: GitLab Product: open_source_gitlab__17.2.9 Product: open_source_gitlab__17.3.5 Product: open_source_gitlab__17.4.2

Summary

GitLab heeft kwetsbaarheden verholpen in Enterprise Edition (EE) en Community Edition (CE).

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, toegang te verkrijgen tot gevoelige gegevens, of code uit te voeren in de context van een andere gebruiker, waaronder ook mogelijk gebruikers met administrator-rechten.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 8

  • Critical 9.6
    CVE-2024-9164

    Missing Authentication for Critical Function in GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.2
    CVE-2024-8970

    Incorrect Authorization in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circums…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.2
    CVE-2024-8977

    Server-Side Request Forgery (SSRF) in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attac…

    GitLab GitLab Web / CMS
  • High 7.5
    CVE-2024-9631

    Inefficient Algorithmic Complexity in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.3
    CVE-2024-6530

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When adding a authorizing an application, it can be made to render a…

    GitLab GitLab Web / CMS
  • Medium 4.9
    CVE-2024-9623

    Incorrect Authorization in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-5005

    Incorrect Provision of Specified Functionality in GitLab

    An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5, all versions starting from 17.4 before 17.4.2 It was possible for guest users to disclose project t…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2024-9596

    Inclusion of Sensitive Information in Source Code in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. It was possible for an unauthenticated attacker to determine the GitLab version number for a GitLab …

    GitLab GitLab Web / CMS

Revision history

  1. #0

    Initiele versie

References