Skip to content
OpenAdvisories
Medium WID-SEC-2023-1945 15 CVEs

GitLab: Mehrere Schwachstellen

Published Aug 1, 2023 · Updated Aug 2, 2023 · Revision 2 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GitLab ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren oder beliebigen Code auszuführen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 15

  • High 8.2
    CVE-2023-3932

    Incorrect User Management in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitr…

    GitLab GitLab Web / CMS
  • High 7.5
    CVE-2023-3364 EPSS 44%

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2023-3994

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2023-0632

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.3
    CVE-2023-3385

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.4
    CVE-2023-2164 EPSS 66%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2023-4002

    Insertion of Sensitive Information Into Sent Data in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy …

    GitLab GitLab Web / CMS
  • Medium 5.3
    CVE-2023-4008

    Incorrect Ownership Assignment in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URL…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.9
    CVE-2023-3993

    Insertion of Sensitive Information into Log File in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a spec…

    GitLab GitLab Web / CMS
  • Medium 4.8
    CVE-2023-3401

    Improper Control of Generation of Code ('Code Injection') in GitLab

    An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to cre…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.8
    CVE-2023-3500

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML di…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-2022

    Missing Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on prot…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-3900

    Improper Validation of Specified Type of Input in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not loa…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-4011

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.

    GitLab GitLab Web / CMS
  • Low 3.1
    CVE-2023-1210

    Generation of Error Message Containing Sensitive Information in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for group…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References