Summary
GitLab heeft kwetsbaarheden verholpen in GitLab CE/EE (Specifiek voor versies 14.1 tot 17.8.2).
Details
Interpretaties
De kwetsbaarheden omvatten een denial-of-service kwetsbaarheid, een externe service interactie kwetsbaarheid, een kritieke XSS kwetsbaarheid, onjuiste autorisatie kwetsbaarheden, een onveilige directe objectreferentie kwetsbaarheid, een probleem met ingetrokken Personal Access Tokens, en een kritieke informatie openbaarmaking kwetsbaarheid. Deze kwetsbaarheden kunnen door kwaadwillenden worden misbruikt om de beschikbaarheid van de diensten te verstoren, ongeautoriseerde toegang te verkrijgen tot gevoelige gegevens, en gevoelige informatie te onthullen.
Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 8
-
High 8.7
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.
-
Medium 6.5
Allocation of Resources Without Limits or Throttling in GitLab
A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter i…
-
Medium 6.4
Improper Neutralization of Input Used for LLM Prompting in GitLab
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injecti…
-
Medium 4.9
Files or Directories Accessible to External Parties in GitLab
An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.
-
Medium 4.3
Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.
-
Medium 4.3
Incorrect Authorization in GitLab
Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data.
-
Medium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information.
-
Medium 4.2
Insufficient Session Expiration in GitLab
An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming resul…
Revision history
-
#0
Initiele versie
References
-
Reference - certbundde
https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/