Skip to content
OpenAdvisories
High WID-SEC-2023-1370 14 CVEs

GitLab: Mehrere Schwachstellen

Published Jun 5, 2023 · Updated Jun 5, 2023 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um seine Rechte zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 14

  • High 8.7
    CVE-2023-2442 EPSS 96%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions st…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2023-2132

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions sta…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2023-2198

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions star…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2023-2199

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions sta…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2023-0121

    Allocation of Resources Without Limits or Throttling in GitLab

    A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.9
    CVE-2023-2589

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starti…

    GitLab GitLab Web / CMS
  • Medium 4.4
    CVE-2023-2015

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions sta…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.4
    CVE-2023-2485

    Incorrect Privilege Assignment in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-0921 EPSS 84%

    Allocation of Resources Without Limits or Throttling in GitLab

    A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturat…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-1204

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions sta…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-2001

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 be…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.1
    CVE-2023-0508

    Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.1
    CVE-2023-1825

    Insertion of Sensitive Information Into Sent Data in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user…

    GitLab GitLab Web / CMS
  • Low 2.6
    CVE-2023-2013

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions star…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References