Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
Product
GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.
Vulnerabilities 17
-
High 7.5
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions …
-
High 7.3
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.…
-
High 7.3
Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an …
-
High 7.1
Grafana account takeover via OAuth vulnerability
Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a l…
-
Medium 6.8
An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all ver…
-
Medium 6.5
An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 befo…
-
Medium 6.5
Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, an…
-
Medium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions star…
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting f…
-
Medium 5.3
Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 1…
-
Medium 5.3
Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15…
-
Medium 4.3
It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions f…
-
Medium 4.3
An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions startin…
-
Low 3.5
A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prio…
-
Low 3.5
Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to…
-
Low 2.7
An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4,…
-
Low 2.7
Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions s…
Revision history
-
#2
Neue Updates von SUSE aufgenommen
-
#1
Initiale Fassung
References
-
SUSE Security Update SUSE-SU-2022:4428-1 vom 2022-12-13
https://lists.suse.com/pipermail/sle-security-updates/2022-December/013218.html
-
GitLab Security Release: 15.4.1, 15.3.4, and 15.2.5 vom 2022-09-29
https://about.gitlab.com/releases/2022/09/29/security-release-gitlab-15-4-1-released/