Medium WID-SEC-2022-2207 12 CVEs

GitLab: Mehrere Schwachstellen

Published Nov 30, 2022 · Updated Feb 6, 2023 · Revision 3 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder sonstige Auswirkungen zu verursachen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 12

Critical 9.3

CVE-2022-3572

A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4…

GitLab GitLab gitlab Web / CMS Ubuntu

Jan 24, 2023
Medium 6.5

CVE-2022-3740

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 1…

GitLab GitLab gitlab Web / CMS Ubuntu

Jan 24, 2023
Medium 6.5

CVE-2022-3820

An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.…

GitLab GitLab gitlab Web / CMS Ubuntu

Jan 24, 2023
Medium 6.3

CVE-2022-4205

In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.

GitLab GitLab gitlab Web / CMS Ubuntu

Jan 27, 2023
Medium 5.5

CVE-2022-3902

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting fr…

GitLab GitLab gitlab Web / CMS Ubuntu

Jan 24, 2023
Medium 5.5

CVE-2022-4054

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting fr…

GitLab GitLab gitlab Web / CMS Ubuntu

Jan 24, 2023
Medium 5.3

CVE-2022-3482

An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4…

GitLab GitLab gitlab Web / CMS Ubuntu

Jan 24, 2023
Medium 5.0

CVE-2022-4206

A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102…

GitLab DAST API scanner gitlab Ubuntu

Feb 1, 2023
Medium 4.3

CVE-2022-3478

An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting f…

GitLab GitLab gitlab Web / CMS Ubuntu

Jan 24, 2023
Medium 4.3

CVE-2022-4255

An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.…

GitLab GitLab Web / CMS

Jan 27, 2023
Medium 4.3

CVE-2022-4335

A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 …

GitLab GitLab Web / CMS

Jan 27, 2023
Low 3.5

CVE-2022-4201

A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 al…

GitLab GitLab gitlab Web / CMS Ubuntu

Jan 27, 2023

Revision history

2023-02-06 #3
CVE ergänzt
2023-01-29 #2
CVE's ergänzt
2022-11-30 #1
Initiale Fassung

References

GitL vom 2022-11-30
https://about.gitlab.com/releases/2022/11/30/security-release-gitlab-15-6-1-released/