Skip to content
OpenAdvisories
Medium WID-SEC-2023-2244 12 CVEs

GitLab: Mehrere Schwachstellen

Published Aug 31, 2023 · Updated Sep 3, 2023 · Revision 2 · de-DE

Platform: Linux

Summary

Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um8 Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen und seine Privilegien zu erweitern.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 12

  • Medium 6.5
    CVE-2023-3205

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importi…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2023-3210

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importi…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2023-3915

    Incorrect Execution-Assigned Permissions in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that exte…

    GitLab GitLab Web / CMS
  • Medium 5.5
    CVE-2023-3950

    Cleartext Storage of Sensitive Information in GitLab

    An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can no…

    GitLab GitLab Web / CMS
  • Medium 5.5
    CVE-2023-4378

    Insertion of Sensitive Information Into Sent Data in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2023-4647

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leadi…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.0
    CVE-2022-4343

    Exposure of Sensitive Information to an Unauthorized Actor in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site prof…

    GitLab GitLab Web / CMS
  • Medium 5.0
    CVE-2023-4630

    Missing Authorization in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imp…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-4018

    Direct Request ('Forced Browsing') in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.5
    CVE-2023-0120

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 2.7
    CVE-2023-1555

    Missing Authorization in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 2.6
    CVE-2023-1279

    URL Redirection to Untrusted Site in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a differen…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #2

    CVE ergänzt

  2. #1

    Initiale Fassung

References